khanbmnxls
This report shows the evidence for khanbmnxls@1.0.0. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection confirms a disguised challenge page whose callback performs an obfuscated external redirect with query forwarding. Although it has no install hook, this is concrete malicious browser behavior.
Static reason
No blocking static signals were detected.
Trigger
A browser loads index.html and the Turnstile callback runs.
Impact
Enables concealed delivery or phishing through a remote destination.
Mechanism
Obfuscated query-preserving browser redirect
Attack narrative
The sole package payload is an HTML page styled as a Cloudflare verification screen. Once its verification callback fires, obfuscated code builds a non-Cloudflare HTTPS destination, transfers every URL query parameter to it, and replaces the current page. The concealed remote redirect is unrelated to a legitimate npm package function and can route users or embedded contexts to attacker-controlled content.
AI rationale
Source inspection confirms a disguised challenge page whose callback performs an obfuscated external redirect with query forwarding. Although it has no install hook, this is concrete malicious browser behavior.
Evidence
package.jsonindex.html
Network endpoints1
challenges.cloudflare.com
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.html is the declared main entry and embeds a fake Cloudflare verification page.
- The Turnstile completion callback contains heavily obfuscated JavaScript.
- Callback constructs an obfuscated external HTTPS URL and redirects window.location.
- It copies all current URL query parameters to the redirect destination.
Evidence against
- package.json has no lifecycle scripts or dependencies.
- No filesystem, credential, or child-process access appears in the package.
Behavioral surface
NoLicense
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
4 High1 Low
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
LowNo License
Affected versions and remediation
This report applies to khanbmnxls@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing khanbmnxls@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.