registry / khanbmnxls / 1.0.0

khanbmnxls@1.0.0

AI Security Review

scanned 8d ago · by lpm-firewall-ai

Loading the package's HTML entry displays a Cloudflare-themed challenge. Its completion callback redirects the browser to an obfuscated external HTTPS destination while preserving query parameters.

Static reason

No blocking static signals were detected.

Trigger

A browser loads index.html and the Turnstile callback runs.

Impact

Enables concealed delivery or phishing through a remote destination.

Mechanism

Obfuscated query-preserving browser redirect

Attack narrative

The sole package payload is an HTML page styled as a Cloudflare verification screen. Once its verification callback fires, obfuscated code builds a non-Cloudflare HTTPS destination, transfers every URL query parameter to it, and replaces the current page. The concealed remote redirect is unrelated to a legitimate npm package function and can route users or embedded contexts to attacker-controlled content.

Rationale

Source inspection confirms a disguised challenge page whose callback performs an obfuscated external redirect with query forwarding. Although it has no install hook, this is concrete malicious browser behavior.

Evidence

package.jsonindex.html

Network endpoints1

challenges.cloudflare.com

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13820

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in khanbmnxls (npm)

Details

The package contains a single index.html that impersonates a Cloudflare Turnstile 'Just a moment...' challenge page. The inline JavaScript is heavily obfuscated (obfuscator.io-style `_0xNNNN` identifiers and a shuffled string array) and assembles a redirect URL beginning with `https://kh` from decoded string fragments, wired to a fake `data-sitekey` and an `onTurnstileComplete` callback. The package declares no npm lifecycle scripts (no preinstall/install/postinstall/prepare), no JavaScript `main`, and no `bin` entry, so `npm install` and `require()` of this package do not execute the HTML or its embedded script. The harm surface is limited to a browser that renders the file directly; developers installing the package from npm are not attacked at install or import time. The artifact is a phishing/redirect lure hosted on the npm registry rather than a functional Node package. ## Source: ghsa-malware (30db27aba41dd5dea17f1a3454277a9482c18d34fd9cd5d2ac8af1d8ea8f4eb0) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

OSV advisory ADVISORY PACKAGE

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for block

index.html is the declared main entry and embeds a fake Cloudflare verification page.
The Turnstile completion callback contains heavily obfuscated JavaScript.
Callback constructs an obfuscated external HTTPS URL and redirects window.location.
It copies all current URL query parameters to the redirect destination.

Evidence against

package.json has no lifecycle scripts or dependencies.
No filesystem, credential, or child-process access appears in the package.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 0 file(s), 0 B of source

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

No flagged code excerpts are attached to this scan.

Findings

4 High1 Low

HighAi Review Evidence

LowNo License