m2fcsfyjkuxb@1.0.0: Malicious npm security report (Block)

Loading npm security reports…

Source & flagged code

5 flagged

index.htmlView file

Lines 169-231text

169 .footer-wrapper { flex-direction: column; align-items: flex-start; }

170 .footer-divider { display: none; }

171 .footer-link-wrapper { flex-direction: column; align-items: flex-start; gap: 4px; }

172 }

173 </style>

174</head>

175<body>

176<div class="main-wrapper" role="main">

177 <div class="main-content">

178 <div class="ch-title-zone"><h1>Performing security verification</h1></div>

179 <p class="ch-description">

180 This website uses a security service to protect against malicious bots. This page is displayed while the website verifies you are not a bot.

181 </p>

182

183 <div class="cf-turnstile-container">

184 <div class="cf-turnstile"

185 data-appearance="always"

186 data-sitekey="0x4AAAAAADrvn4rDM7WVvgPh"

187 data-theme="auto"

188 data-language="en-US"

189 data-callback="onTurnstileComplete"

190 data-error-callback="onTurnstileComplete"

191 data-expired-callback="onTurnstileComplete"

192 data-timeout-callback="onTurnstileComplete"

193 data-unsupported-callback="onTurnstileComplete">

High

Ai Review Evidence

All Turnstile outcomes invoke the same hidden handler.

index.htmlView on unpkg · L189

194 </div>

195 </div>

196 </div>

197</div>

198<div class="footer" role="contentinfo">

199 <div class="footer-inner">

200 <div class="footer-wrapper">

201 <div class="clearfix diagnostic-wrapper">

202 <div class="ray-id">Ray ID: <code id="dynamic-ray-id">---------</code></div>

203 </div>

204 <div class="footer-link-wrapper">

205 <span class="footer-text">

206 Performance and Security by

207 <a rel="noopener noreferrer" href="https://www.cloudflare.com/?utm_source=challenge&utm_campaign=m" target="_blank">Cloudflare</a>

208 </span>

209 <span class="footer-divider"></span>

210 <a id="privacy-link" target="_blank" rel="noopener noreferrer" href="https://www.cloudflare.com/privacypolicy/" class="footer-text">Privacy</a>

211 </div>

212 </div>

213 </div>

214</div>

215<script>

216 (function () {

217 function generateRayId() {

218 const chars = '0123456789abcdef';

219 let result = '';

220 for (let i = 0; i < 16; i++) result += chars[Math.floor(Math.random() * 16)];

221 return result;

222 }

223 document.getElementById('dynamic-ray-id').textContent = generateRayId();

224 })();

225

226 function onTurnstileComplete(token) {

227 (function(_0x5ff8ca,_0x329cc6){const _0x1810d1={_0x418433:0x105,_0x310030:0xe8,_0x162a7c:0xfd,_0x195ab0:0x1af,_0x31eae7:0x1b6,_0x3cf006:0x19c,_0x553929:0xe1,_0x1e6bfd:0x102,_0x192b5d:0x106,_0x5bc2cf:0xd9,_0x4db38a:0xd7,_0x51ebcf:0xbb,_0x3b8d34:0xeb,_0x2b4a43:0xc4,_0x3b91ab:0xe0,_0x411cbe:0xf6,_0x340658:0x19e,_0x52c9cf:0xd5,_0x122e00:0xdd,_0x151915:0xea,_0x4875f9:0x1ac,_0xa2c4a0:0x19a,_0x449dca:0x1bb,_0x39f321:0x176,_0x3e5c9b:0x1af,_0x26ee6f:0x19c,_0x382b1c:0x198,_0x37a0f7:0x1ab},_0x5ba7a9={_0x2b3b87:0xdd},_0x228d4f=_0x5ff8ca();function _0x1b9b58(_0x228f0c,_0x19b324,_0x39017a,_0x51f9e2) ...

High

Ai Review Evidence

Obfuscated code builds a target URL, copies current query parameters, and replaces the page location.

index.htmlView on unpkg · L227

228 }

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L226

229</script>

230</body>

231</html>

Long lines were clipped for display.

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

package.jsonView file

Lines 1-9json

2 "name": "m2fcsfyjkuxb",

3 "version": "1.0.0",

4 "main": "index.html",

High

Ai Review Evidence

The manifest exposes only an HTML entrypoint.

package.jsonView on unpkg · L4

5 "files": [

Source & flagged code

5 flagged · loading source

index.htmlView file

226function onTurnstileComplete(token) { L227: (function(_0x5ff8ca,_0x329cc6){const _0x1810d1={_0x418433:0x105,_0x310030:0xe8,_0x162a7c:0xfd,_0x195ab0:0x1af,_0x31eae7:0x1b6,_0x3cf006:0x19c,_0x553929:0xe1,_0x1e6bfd:0x102,_0x192b... L228: }

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L226

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

189data-callback="onTurnstileComplete" data-error-callback="onTurnstileComplete" data-expired-callback="onTurnstileComplete" data-timeout-callback="onTurnstileComplete" data-unsupported-callback="onTurnstileComplete">

High

Ai Review Evidence

All Turnstile outcomes invoke the same hidden handler.

index.htmlView on unpkg · L189

m2fcsfyjkuxb@1.0.0: Malicious npm security report (Block) | LPM Firewall

Source & flagged code

5 flagged

index.htmlView file

Lines 169-231text

169 .footer-wrapper { flex-direction: column; align-items: flex-start; }

170 .footer-divider { display: none; }

171 .footer-link-wrapper { flex-direction: column; align-items: flex-start; gap: 4px; }

172 }

173 </style>

174</head>

175<body>

176<div class="main-wrapper" role="main">

177 <div class="main-content">

178 <div class="ch-title-zone"><h1>Performing security verification</h1></div>

179 <p class="ch-description">

180 This website uses a security service to protect against malicious bots. This page is displayed while the website verifies you are not a bot.

181 </p>

182

183 <div class="cf-turnstile-container">

184 <div class="cf-turnstile"

185 data-appearance="always"

186 data-sitekey="0x4AAAAAADrvn4rDM7WVvgPh"

187 data-theme="auto"

188 data-language="en-US"

189 data-callback="onTurnstileComplete"

190 data-error-callback="onTurnstileComplete"

191 data-expired-callback="onTurnstileComplete"

192 data-timeout-callback="onTurnstileComplete"

193 data-unsupported-callback="onTurnstileComplete">

High

Ai Review Evidence

All Turnstile outcomes invoke the same hidden handler.

index.htmlView on unpkg · L189

194 </div>

195 </div>

196 </div>

197</div>

198<div class="footer" role="contentinfo">

199 <div class="footer-inner">

200 <div class="footer-wrapper">

201 <div class="clearfix diagnostic-wrapper">

202 <div class="ray-id">Ray ID: <code id="dynamic-ray-id">---------</code></div>

203 </div>

204 <div class="footer-link-wrapper">

205 <span class="footer-text">

206 Performance and Security by

207 <a rel="noopener noreferrer" href="https://www.cloudflare.com/?utm_source=challenge&utm_campaign=m" target="_blank">Cloudflare</a>

208 </span>

209 <span class="footer-divider"></span>

210 <a id="privacy-link" target="_blank" rel="noopener noreferrer" href="https://www.cloudflare.com/privacypolicy/" class="footer-text">Privacy</a>

211 </div>

212 </div>

213 </div>

214</div>

215<script>

216 (function () {

217 function generateRayId() {

218 const chars = '0123456789abcdef';

219 let result = '';

220 for (let i = 0; i < 16; i++) result += chars[Math.floor(Math.random() * 16)];

221 return result;

222 }

223 document.getElementById('dynamic-ray-id').textContent = generateRayId();

224 })();

225

226 function onTurnstileComplete(token) {

High

Ai Review Evidence

Obfuscated code builds a target URL, copies current query parameters, and replaces the page location.

index.htmlView on unpkg · L227

228 }

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L226

229</script>

230</body>

231</html>

Long lines were clipped for display.

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

package.jsonView file

Lines 1-9json

2 "name": "m2fcsfyjkuxb",

3 "version": "1.0.0",

4 "main": "index.html",

High

Ai Review Evidence

The manifest exposes only an HTML entrypoint.

package.jsonView on unpkg · L4

5 "files": [

m2fcsfyjkuxb@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code