registry / learnmathedu / 2.1.4

learnmathedu@2.1.4

math

AI Security Review

scanned 6d ago · by lpm-firewall-ai

On browser load, the carrier dynamically imports a remote loader and its service worker imports a remote worker selected at runtime. The package itself is an obfuscated staged payload carrier rather than a self-contained application.

Static reason

One or more suspicious static signals were detected.

Trigger

A user serves or opens index.html in a browser.

Impact

Remote CDN content can change browser-executed application and service-worker behavior after package publication.

Mechanism

Runtime remote-module and service-worker loading from obfuscated CDN sources.

Rationale

This is a concrete staged-payload architecture with mutable remote execution, but there is no install-time behavior, local harvesting, or demonstrated malicious payload in the package. Warn rather than block.

Evidence

index.htmlsw.jsREADME.mdpackage.json

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Runtime dynamically imports externally constructed loader sources and invokes their boot function.
Service worker resolves a worker version through XMLHttpRequest then imports remote code with importScripts.
README describes this package as an obfuscated static carrier whose loader follows a latest tag.

Evidence against

package.json has no preinstall, install, or postinstall hook.
Published files are limited to index.html and sw.js; no local credential or filesystem APIs were found.
README states network events expose only coarse transport state, not ICE candidates or addresses.

Behavioral surface

Source

DynamicRequireNetwork

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTrivial

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 44.1 KB of source

Source & flagged code

6 flagged

index.htmlView file

Lines 1-2html

1<!doctype html><html lang=en><head><meta name="_78oT4Rduo" content="e8bddb4dd742794082fd1f0736f38a708e1a5d04b94e84eb57e3355c514fbc3f"><meta charset=utf-8><meta content="width=device-width,initial-scale=1,viewport-fit=cover" name=viewport><meta content=#8f1558 name=theme-color><meta content=dark name=color-scheme><title>yrneazngurqh</title><style>body,html{height:100%;margin:0;background:#151216}</style></head><body><script type=module>(function(_0x3c2a32,_0x2e3fa5){const _0x490044={_0x3a4bb7:0x24d,_0x2f11f0:0x25d,_0x50815b:0x34a,_0x28de30:0x268,_0x453f4d:0x272,_0x4d22f8:0x2a4,_0x51baa9:0x2d7,_ ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.htmlView on unpkg · L1

Medium

Ai Review Evidence

Runtime dynamically imports externally constructed loader sources and invokes their boot function.

index.htmlView on unpkg · L1

Medium

Ai Review Evidence

Runtime dynamically imports externally constructed loader sources and invokes their boot function.

index.htmlView on unpkg · L1

Long lines were clipped for display.

sw.jsView file

Lines 1-3javascript

1(function(_0x420376,_0x5b93dc){var _0x2d12f4={_0x376caf:0xd4,_0x290d46:0xda,_0x1d8236:0xe2,_0x4e65ed:0xe3,_0x22b359:0xdb,_0x465211:0xe1,_0x20bfef:0xd9,_0x54f2c6:0xe5,_0x1c37b6:0xe7,_0x2a5723:

README.mdView file

Lines 1-21markdown

1# YuriRTC static carrier

3The `learnmathedu` NPM name is retained for existing CDN and deployment links.

4The package contains the two path-portable files a static host needs:

5`index.html` and `sw.js`.

Medium

Ai Review Evidence

README describes this package as an obfuscated static carrier whose loader follows a latest tag.

README.mdView on unpkg · L1

7Build a non-deployable placeholder artifact with `npm run build`. A release

Source & flagged code

6 flagged · loading source

index.htmlView file

1(function(_0x3c2a32,_0x2e3fa5){const _0x490044={_0x3a4bb7:0x24d,_0x2f11f0:0x25d,_0x50815b:0x34a,_0x28de30:0x268,_0x453f4d:0x272,_0x4d22f8:0x2a4,_0x51baa9:0x2d7,_0x5632e3:0x259,_0x4...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.htmlView on unpkg · L1

1async function importFirst(_0x2fafaa){const _0x42f8f8={_0x3ce101:0xcb},_0x5e0af9={_0x5dcafa:0x2be};for(const _0x555e2d of _0x2fafaa){try{return await import(_0x555e2d);}catch{}}function _0x33c9a5(_0x508e9c,_0x352408){return _0x5de1c0(_0x352408,_0x508e9c- -_0x5e0af9._0x5dcafa);}throw new Error(_0x33c9a5(-0x8e,-_0x42f8f8._0x3ce101));}

Medium

Ai Review Evidence

Runtime dynamically imports externally constructed loader sources and invokes their boot function.

index.htmlView on unpkg · L1

1const {boot}=await importFirst(loaderSources);phase(copy[_0x5de1c0(0x2f0,0x29f)]),await boot({...config,'swUrl':_0x5de1c0(0x228,0x2a1),'mount':app,'appPath':'/','onDiagnostics':_0x2d7e28=>{

Medium

Ai Review Evidence

Runtime dynamically imports externally constructed loader sources and invokes their boot function.

index.htmlView on unpkg · L1

Findings

1 High7 Medium2 Low

HighObfuscated Payload Loadersw.js

MediumDynamic Requireindex.html

MediumNetwork

MediumStructural Risk Force Deep Review

MediumAi Review Evidenceindex.html

MediumAi Review Evidencesw.js

MediumAi Review EvidenceREADME.md

LowScripts Present

LowHigh Entropy Strings