registry / learnmathedu / 2.1.7

learnmathedu@2.1.7

math

AI Security Review

scanned 4d ago · by lpm-firewall-ai

Opening the published HTML dynamically imports an external loader; the service worker also imports external code. The remote URLs are obfuscated, so exact hosts are not recoverable from source without execution.

Static reason

One or more suspicious static signals were detected.

Trigger

A user serves or opens index.html in a browser.

Impact

Third-party CDN-controlled code executes in the page and service-worker contexts.

Mechanism

Obfuscated runtime remote-module and service-worker loading.

Rationale

Source establishes a remote executable-code loading chain but does not establish a concrete malicious payload or install-time attack. This is a real unresolved supply-chain risk, warranting a warning rather than a block.

Evidence

index.htmlsw.jsREADME.mdpackage.json

Decision evidence

public snapshot

AI called this Suspicious at 91.0% confidence as Dangerous Capability with low false-positive risk.

Evidence for warning

Runtime dynamically imports remotely constructed loader sources.
Service worker imports code from obfuscated CDN base URLs.
Published artifact is heavily obfuscated and identified as a YuriRTC carrier, not a math package.

Evidence against

No npm preinstall, install, or postinstall lifecycle hook.
No direct credential harvesting, filesystem access, shell execution, or exfiltration is present in the package files.

Behavioral surface

Source

DynamicRequire

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTrivial

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 43.6 KB of source

Source & flagged code

6 flagged

index.htmlView file

Lines 1-2html

1<!doctype html><html lang=en><head><meta name="_PQtmPENlF" content="fb70c438340c455a5af7b624b678f0ab6bd0ff7b1a17e35cdd36b1d710eb3caa"><meta charset=utf-8><meta content="width=device-width,initial-scale=1,viewport-fit=cover" name=viewport><meta content=#8f1558 name=theme-color><meta content=dark name=color-scheme><title>yrneazngurqh</title><style>body,html{height:100%;margin:0;background:#151216}</style></head><body><script type=module>(function(_0x5282c1,_0x9ee295){const _0xbabf98={_0x13062d:0x4e1,_0x4a4c63:0x54a,_0x4a1484:0x490,_0x3b5031:0x472},_0x1a454a=_0x5282c1();function _0x3861d0(_0x324f ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.htmlView on unpkg · L1

Medium

Ai Review Evidence

Runtime dynamically imports remotely constructed loader sources.

index.htmlView on unpkg · L1

Long lines were clipped for display.

sw.jsView file

Lines 1-3javascript

1(function(_0x341f74,_0x3e8795){var _0x671ef6={_0xca6ea0:0x177,_0x2f107a:0x16c,_0x2b902b:0x16c,_0x467b85:0x174,_0x3dc7af:0x169,_0x1666d0:0x16d,_0x4d85d9:0x165,_0x4aa415:0x16b,_0x268434:0x170,_0x2b4e05:0x173,_0x54bc0c:0x16e},_0xf8bf88

README.mdView file

Lines 1-21markdown

1# YuriRTC static carrier

3The `learnmathedu` NPM name is retained for existing CDN and deployment links.

Medium

Ai Review Evidence

Published artifact is heavily obfuscated and identified as a YuriRTC carrier, not a math package.

README.mdView on unpkg · L1

4The package contains the two path-portable files a static host needs:

5`index.html` and `sw.js`.

7Build a non-deployable placeholder artifact with `npm run build`. A release

package.jsonView file

Lines 1-26json

2 "name": "learnmathedu",

3 "version": "2.1.7",

4 "description": "math",

5 "type": "module",

Source & flagged code

6 flagged · loading source

index.htmlView file

1(function(_0x5282c1,_0x9ee295){const _0xbabf98={_0x13062d:0x4e1,_0x4a4c63:0x54a,_0x4a1484:0x490,_0x3b5031:0x472},_0x1a454a=_0x5282c1();function _0x3861d0(_0x324f2f,_0xee190f){retur...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.htmlView on unpkg · L1

1async function importFirst(_0x847a9f){const _0x7a8cb7={_0x3d1c82:0xa7};for(const _0x4230bb of _0x847a9f){try{return await import(_0x4230bb);}catch{}}

Medium

Ai Review Evidence

Runtime dynamically imports remotely constructed loader sources.

index.htmlView on unpkg · L1

sw.jsView file

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

sw.js

Findings

1 High6 Medium2 Low

HighObfuscated Payload Loadersw.js

MediumDynamic Requireindex.html

MediumStructural Risk Force Deep Review

MediumAi Review Evidenceindex.html

MediumAi Review Evidencesw.js

MediumAi Review EvidenceREADME.md

MediumAi Review Evidencepackage.json

LowScripts Present

LowHigh Entropy Strings