registry / kambxjowhdsgyw / 1.0.1

kambxjowhdsgyw@1.0.1

AI Security Review

scanned 24d ago · by lpm-firewall-ai

Opening the package entrypoint runs obfuscated browser code. It decrypts or resolves an undisclosed host, preserves URL parameters, and redirects after a challenge.

Static reason

One or more suspicious static signals were detected.

Trigger

A user or tool opens or imports the HTML entrypoint in a browser context.

Impact

Visitors can be sent to an attacker-controlled site with their original URL parameters.

Mechanism

Obfuscated challenge-gated redirect to a hidden remote destination.

Attack narrative

The package presents an HTML page as its npm entrypoint. When rendered, its obfuscated script performs a Turnstile-style challenge, resolves a destination from hidden encrypted material, copies the current query parameters to that destination, and redirects the browser. This is a concealed traffic-routing mechanism with no stated package function and is consistent with phishing or malicious landing-page delivery.

AI rationale

The package is an opaque, browser-executed redirector that deliberately hides its final destination and carries visitor parameters across the redirect. The absence of install hooks does not neutralize this concrete runtime attack behavior.

Evidence

package.jsonindex.html

Network endpoints1

challenges.cloudflare.com

OSV advisory

OpenSSF/OSV

The package was found to contain malicious code or consuming dependency that contains malicious code ## Source: ghsa-malware (24a5333661877d64a01408993c063ef6f4a943dd4024c01943a63f527a030514) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

kambxjowhdsgyw@1.0.1

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code