registry / lufxchwmxwyps / 1.0.2

lufxchwmxwyps@1.0.2

AI Security Review

scanned 17d ago · by lpm-firewall-ai

The package's only entrypoint is an obfuscated browser challenge page that contacts a concealed endpoint and redirects the visitor. This is unrelated to a normal npm package runtime.

Static reason

One or more suspicious static signals were detected.

Trigger

Loading index.html or importing the declared main entrypoint in a browser context.

Impact

Visitors can be routed through a deceptive challenge to an undisclosed remote destination.

Mechanism

It loads Turnstile, posts a concealed host key through fetch, and invokes redirectToHost after the challenge or a timeout.

Attack narrative

The package presents a Cloudflare-style challenge while hiding its operational logic in a large obfuscated script. On load, it uses a concealed key in a remote request and automatically calls a redirect routine after the challenge or timeout. The undisclosed destination and deceptive browser flow create a concrete phishing or traffic-redirection capability.

AI rationale

The sole npm entrypoint is an obfuscated remote challenge-and-redirect page, not package functionality. Its concealed request and automatic redirect constitute concrete malicious behavior.

Evidence

package.jsonindex.html

Network endpoints2

challenges.cloudflare.comchallenges.cloudflare.com/turnstile/v0/api.js

Decision evidence

public snapshot

AI called this Malicious at 94.0% confidence as Malware with low false-positive risk.

Evidence for block

The package declares an HTML page as its only runtime entrypoint.
The entrypoint loads Cloudflare Turnstile and invokes a hidden challenge-redirect callback after completion.
Obfuscated code sends a JSON request containing a concealed host key, then schedules a redirect function automatically.
The runtime is deliberately heavily obfuscated, concealing its endpoint selection and redirect logic.

Evidence against

No npm lifecycle hook or filesystem mutation was found in package.json.
No direct credential or local-file harvesting primitive was identified in the inspected entrypoint.

Behavioral surface

Source

Eval

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Manifest

NoLicense

scanned 1 file(s), 83.4 KB of source

Source & flagged code

4 flagged

index.htmlView file

182} L183: (function(_0xbc02e6,_0x3c7f22){const _0x21741b={_0x10eb72:0x5e,_0x2cf72f:0x50,_0x91d475:0xfa,_0xd946ab:0x17c,_0x3f5aa0:0x5c,_0x1ea60d:0x48,_0x3b42c3:0xb0,_0x26d71b:0x1e,_0x25eb33:0...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L182

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

183setTimeout(function(){_0x1270af['upXPp'](redirectToHost);},-0x25d4+0x8e4+0x20d8);

High

Ai Review Evidence

Obfuscated code sends a JSON request containing a concealed host key, then schedules a redirect function automatically.

index.htmlView on unpkg · L183

package.jsonView file

1{ "name": "lufxchwmxwyps", "version": "1.0.2", "main": "index.html", "files": [ "index.html" ]

High

Ai Review Evidence

The package declares an HTML page as its only runtime entrypoint.

package.jsonView on unpkg · L1

Source & flagged code

4 flagged · loading source

index.htmlView file

182} L183: (function(_0xbc02e6,_0x3c7f22){const _0x21741b={_0x10eb72:0x5e,_0x2cf72f:0x50,_0x91d475:0xfa,_0xd946ab:0x17c,_0x3f5aa0:0x5c,_0x1ea60d:0x48,_0x3b42c3:0xb0,_0x26d71b:0x1e,_0x25eb33:0...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L182

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

183setTimeout(function(){_0x1270af['upXPp'](redirectToHost);},-0x25d4+0x8e4+0x20d8);

High

Ai Review Evidence

Obfuscated code sends a JSON request containing a concealed host key, then schedules a redirect function automatically.

index.htmlView on unpkg · L183

package.json

Findings

4 High1 Medium3 Low

HighObfuscated Payload Loaderindex.html

HighSemantic Analysis Limitedindex.html

HighAi Review Evidencepackage.json

HighAi Review Evidenceindex.html

MediumStructural Risk Force Deep Review

LowEval

LowHigh Entropy Strings

LowNo License

Affected versions and remediation

This report applies to lufxchwmxwyps@1.0.2.

See version security history for other recorded verdicts.

Avoid installing lufxchwmxwyps@1.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-22 00:27:41.048Z (UTC).