registry / learnmathedu / 1.2.0

learnmathedu@1.2.0

Obfuscated, path-portable YuriRTC static carrier. The package name is retained for deployment compatibility.

AI Security Review

scanned 14d ago · by lpm-firewall-ai

Opening index.html dynamically loads remote JavaScript; its service worker also imports remote code. The remote loader can change behavior independently of the package tarball.

Static reason

One or more suspicious static signals were detected.

Trigger

A user deploys or opens index.html in a browser.

Impact

Remote code executes in the page and service-worker contexts of a deployed site.

Mechanism

Obfuscated dynamic imports and service-worker importScripts from CDN URLs.

Rationale

The package contains a concrete remote-code loading surface but no npm lifecycle execution or confirmed malicious local payload. This is a staged payload carrier requiring a warning rather than a block.

Evidence

package.jsonindex.htmlsw.jsREADME.md

Network endpoints2

unpkg.com/@edurocks-group/loader@0.2.12/dist/bundle/sw.jscdn.jsdelivr.net/npm/@edurocks-group/loader@0.2.12/dist/bundle/sw.js

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

learnmathedu@1.2.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code