registry / Malware / kambxjowhdsgyw

kambxjowhdsgyw

This report shows the evidence for kambxjowhdsgyw@1.0.2. 3 of 3 known versions are blocked or flagged. See all versions.

AI Security Review

scanned 1mo ago · by lpm-firewall-ai

This is a concrete opaque browser redirect chain with a concealed remote destination and no legitimate package functionality. Although it has no npm lifecycle hook, opening its declared entry activates the malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

A user opens or serves index.html in a browser.

Impact

Can route visitors to an undisclosed remote destination while carrying visitor URL parameters.

Mechanism

Obfuscated encrypted redirect loader with remote policy fetch.

Attack narrative

The only package entry is a browser page disguised as a Cloudflare verification screen. Its obfuscated inline code derives a hidden host through AES decryption, requests redirect information from that host, appends visitor parameters, and redirects the browser. The destination is concealed from static review, so the page acts as a staged redirector rather than a transparent package feature.

AI rationale

Evidence

index.html

Network endpoints1

challenges.cloudflare.com/turnstile/v0/api.js

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for block

The sole browser entry loads a third-party Cloudflare challenge script.
Its inline script is deliberately obfuscated and decrypts a concealed host URL before fetching redirect policy data.
The script collects visitor URL parameters and replaces the browser location with a remotely supplied redirect.
The package contains no stated application functionality beyond this opaque challenge-and-redirect page.

Evidence against

package.json has no install or lifecycle scripts.
The inspected files do not show local file access, environment access, or child-process execution.

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Manifest

NoLicense

scanned 1 file(s), 86.8 KB of source

Source & flagged code

5 flagged

index.htmlView file

182} L183: (function(_0x2bf8cc,_0xcbadfd){const _0x36d2d1={_0x596fa2:0x27,_0x49318b:0x25,_0x121056:0x12,_0x1544f3:0x63,_0x317740:0x1c,_0x4ea097:0xdd,_0x5e39cc:0x94,_0x308e95:0x4c2,_0x49c3cd:0...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L182

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

9<link rel="preconnect" href="https://challenges.cloudflare.com" /> <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

High

Ai Review Evidence

The sole browser entry loads a third-party Cloudflare challenge script.

index.htmlView on unpkg · L9

176<script> function onTurnstileComplete(token) { if (window.__challengeRedirect) { window.__challengeRedirect(); }

High

Ai Review Evidence

The script collects visitor URL parameters and replaces the browser location with a remotely supplied redirect.

index.htmlView on unpkg · L176

package.jsonView file

1{ "name": "kambxjowhdsgyw", "version": "1.0.2", "main": "index.html", "files": [ "index.html" ]

High

Ai Review Evidence

The package contains no stated application functionality beyond this opaque challenge-and-redirect page.

package.jsonView on unpkg · L1

Source & flagged code

5 flagged · loading source

index.htmlView file

182} L183: (function(_0x2bf8cc,_0xcbadfd){const _0x36d2d1={_0x596fa2:0x27,_0x49318b:0x25,_0x121056:0x12,_0x1544f3:0x63,_0x317740:0x1c,_0x4ea097:0xdd,_0x5e39cc:0x94,_0x308e95:0x4c2,_0x49c3cd:0...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L182

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

9<link rel="preconnect" href="https://challenges.cloudflare.com" /> <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

High

Ai Review Evidence

The sole browser entry loads a third-party Cloudflare challenge script.

index.htmlView on unpkg · L9

176

Findings

5 High2 Medium2 Low

HighObfuscated Payload Loaderindex.html

HighSemantic Analysis Limitedindex.html

HighAi Review Evidenceindex.html

HighAi Review Evidencepackage.json

MediumNetwork

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowNo License

Affected versions and remediation

This report applies to kambxjowhdsgyw@1.0.2.

The versions list below shows the verdict for each recorded version.

Avoid installing kambxjowhdsgyw@1.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-23 04:30:52.061Z (UTC).

Source advisory published: 2026-09-22 18:13:09.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

3 known versions

1.0.2latestshownMaliciousMalwareBlockPublishedSep 14, 2026, 8:33 AM 1.0.1MaliciousMalwareBlockPublishedSep 14, 2026, 8:17 AM 1.0.0MaliciousMalwareBlockPublishedSep 14, 2026, 7:08 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Related packages

Other malware packages

Source & flagged code