registry / learnmathedu / 2.0.1

learnmathedu@2.0.1

math

AI Security Review

scanned 17d ago · by lpm-firewall-ai

Opening index.html loads an obfuscated remote module. That module is given sw.js, whose install path imports further remote code into a service-worker context.

Static reason

One or more suspicious static signals were detected.

Trigger

A user deploys or opens index.html in a browser.

Impact

Remote operator-controlled code can run in the page and service-worker scope for the deployed origin.

Mechanism

Obfuscated dynamic import and service-worker importScripts loader.

Rationale

No install-time compromise is present, but the package is a staged remote-payload carrier with hidden loader URLs. The documented architecture explains its purpose but does not remove the runtime supply-chain risk.

Evidence

package.jsonindex.htmlsw.jsREADME.md

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

sw.js obfuscates two importScripts URLs and loads the first available remote script.
index.html obfuscates and dynamically imports a remote loader at page runtime.
README.md calls this a static carrier and documents an external YuriRTC loader.

Evidence against

package.json has no preinstall/install/postinstall hook.
Packaged files contain no Node filesystem, shell, credential-harvesting, or exfiltration code.
README.md describes the remote loader as the intended application architecture.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsMinifiedTrivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 3.29 KB of source

Source & flagged code

1 flagged

sw.jsView file

Lines 1-3javascript

1function _0x4754(){var _0x3f3bc2=['Ahr0Chm6lY9Jzg4UANnKzwXPDNiUBMv0l25WBs9azwr1CM9JA3mTz3jVDxaVBg9HzgvYqgXHDgvZDc9KAxn0l2j1BMrSzs9ZDY5QCW','mti5mtaXtM1HvhPt','otuWodi4nfniv3DjEq','Ahr0Chm6lY91BNbRzY5JB20VqgvKDxjVy2TZlwDYB3vWl2XVywrLCKbSyxrLC3qVzgLZDc9IDw5KBguVC3CUANm','ntm4nZGZmgTHBuT5sG','mtyYs3bMq2Lk','mtfNywLqA2O','mJu1ntq2r1LWqLPY','mtmYndyZnKzpvxnnCG','m0flrvHrzW','ogTfu0nnDW','w1L1CMLsvenDihDVCMTLCIbZB3vYy2uGDw5YzwfJAgfIBgu','D2fYBG','mtqYode2meHOtgDgza','mMDNDxLQzW','BgvUz3rO','wxvYAvjuqZOGBM8GD29YA2vYihnVDxjJzsbYzwfJAgfIBgu','mtuYnZq3EM1oAhnP'];_0x4754=function(){return _0x3f3bc2;};ret ...

2/*7b39775d5c7156c56c7a56e79a0cdaee33be3c3263bcc3c6ce21687dfb4395ef*/

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

sw.jsView on unpkg · L1

Long lines were clipped for display.

Source & flagged code

1 flagged · loading source

sw.jsView file

1function _0x4754(){var _0x3f3bc2=['[redacted]','mti5mtaXtM1HvhPt','otuWodi4nfniv3DjEq','... L2: /*[redacted]*/

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

sw.jsView on unpkg · L1

Findings

1 High1 Medium2 Low

HighObfuscated Payload Loadersw.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings