registry / learnmathedu / 2.1.8

learnmathedu@2.1.8

math

AI Security Review

scanned 19h ago · by lpm-firewall-ai

Opening the packaged HTML dynamically imports an opaque remote loader; its service worker imports another opaque remote script. The source does not reveal the remote endpoints or payloads.

Static reason

One or more suspicious static signals were detected.

Trigger

Opening index.html in a compatible browser and service-worker startup

Impact

A remote CDN-controlled payload can execute in the page or service-worker context.

Mechanism

Obfuscated runtime remote-code loading

Rationale

No install-time mutation or direct credential/destructive behavior is present, but the package is an obfuscated staged runtime loader with unverifiable remote code. Treat it as a staged payload carrier and warn rather than block.

Evidence

index.htmlsw.jspackage.json

Decision evidence

public snapshot

AI called this Suspicious at 90.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

index.html dynamically imports code from opaque runtime sources.
sw.js loads and executes an opaque remote worker script with importScripts.
Both shipped runtime files are heavily obfuscated, preventing endpoint and payload verification.

Evidence against

package.json has no preinstall, install, or postinstall hook.
The published file list contains only index.html and sw.js.
No package-source credential harvesting, filesystem access, or destructive action was identified.

Behavioral surface

Source

DynamicRequire

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTrivial

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 43.2 KB of source

Source & flagged code

4 flagged

index.htmlView file

Lines 1-2html

1<!doctype html><html lang=en><head><meta name="_vUXB8VAbv" content="2f073a8edd3e14bd2042c9c6e53856939e54685c6ee7674165d78702e7ccc79a"><meta charset=utf-8><meta content="width=device-width,initial-scale=1,viewport-fit=cover" name=viewport><meta content=#8f1558 name=theme-color><meta content=dark name=color-scheme><title>yrneazngurqh</title><style>body,html{height:100%;margin:0;background:#151216}</style></head><body><script type=module>(function(_0x3a1b97,_0x109391){const _0x1f8780={_0x143e6f:0xb6,_0x22d2bd:0x123,_0x40d5a9:0xca,_0x2e63b6:0x11c,_0x3ebffe:0x14a,_0x46f7f5:0x1bc,_0x404f8b:0x139,_0x ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.htmlView on unpkg · L1

Medium

Ai Review Evidence

index.html dynamically imports code from opaque runtime sources.

index.htmlView on unpkg · L1

Long lines were clipped for display.

sw.jsView file

Lines 1-3javascript

1(function(_0x2eb52c,_0x3c1968){var _0x137b56={_0x5bcda8:0x293,_0x5d8893:0x28d,_0x344fe4:0x294,_0x19163c:0x28c,_0x184bc8:0x283,_0x2ae77c:0x287,_0x2f0c49:0x295,_0x5e1ae5:0x295,_0x1b53ab:0x29d,_0x5bdea0:0x288,_0x2f8f78:0x28b,_0x333a77:

Source & flagged code

4 flagged · loading source

index.htmlView file

1(function(_0x3a1b97,_0x109391){const _0x1f8780={_0x143e6f:0xb6,_0x22d2bd:0x123,_0x40d5a9:0xca,_0x2e63b6:0x11c,_0x3ebffe:0x14a,_0x46f7f5:0x1bc,_0x404f8b:0x139,_0x2dac79:0x1f5,_0x951...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.htmlView on unpkg · L1

1async function importFirst(_0x2abb5e){const _0x193612={_0x39cb19:0x23d};for(const _0x29a838 of _0x2abb5e){try{return await import(_0x29a838);}catch{}}function _0xe9fab7(_0x361126,_0x111538){return _0x4e5459(_0x361126,_0x111538-0x404);}throw new Error(_0xe9fab7(_0x193612._0x39cb19,0x2aa));}

Medium

Ai Review Evidence

index.html dynamically imports code from opaque runtime sources.

index.htmlView on unpkg · L1

sw.jsView file

High

Obfuscated Payload Loader

Findings

1 High4 Medium2 Low

HighObfuscated Payload Loadersw.js

MediumDynamic Requireindex.html

MediumStructural Risk Force Deep Review

MediumAi Review Evidenceindex.html

MediumAi Review Evidencesw.js

LowScripts Present

LowHigh Entropy Strings