registry / mn2adskhweox / 1.0.0

mn2adskhweox@1.0.0

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Opening the HTML and completing or failing its Turnstile challenge activates an obfuscated remote redirector. The destination endpoint is concealed and supplied through encrypted server data.

Static reason

One or more suspicious static signals were detected.

Trigger

A browser loads index.html and invokes the Turnstile callback.

Impact

Can route users to an attacker-controlled destination while preserving URL parameters.

Mechanism

Obfuscated remote URL retrieval, decryption, query forwarding, and browser redirect.

Attack narrative

The sole package entrypoint is a fake security-verification page. Its Turnstile callback sends an obfuscated key to a concealed remote endpoint, decrypts a returned destination URL, copies the current page query parameters to it, and redirects the browser. This is a concrete staged phishing or traffic-redirection chain, not a legitimate npm package function.

Rationale

The package contains no usable library code; its only executable artifact is an obfuscated, server-directed redirector hidden behind a Cloudflare-style challenge. No install hook is needed for the browser-targeted malicious behavior.

Evidence

package.jsonindex.html

Network endpoints1

challenges.cloudflare.com

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

index.html disguises execution behind a Turnstile callback.
The callback contains heavily obfuscated code that POSTs a generated host key to a concealed endpoint.
It decrypts the server response into a URL, forwards current query parameters, and redirects the browser.

Evidence against

package.json declares no lifecycle scripts.
Package contents are limited to package.json and index.html.

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Manifest

NoLicense

scanned 1 file(s), 29.6 KB of source

Source & flagged code

6 flagged

index.htmlView file

Lines 206-231html

206 Performance and Security by

207 <a rel="noopener noreferrer" href="https://www.cloudflare.com/?utm_source=challenge&utm_campaign=m" target="_blank">Cloudflare</a>

208 </span>

209 <span class="footer-divider"></span>

210 <a id="privacy-link" target="_blank" rel="noopener noreferrer" href="https://www.cloudflare.com/privacypolicy/" class="footer-text">Privacy</a>

211 </div>

212 </div>

213 </div>

214</div>

215<script>

Source & flagged code

6 flagged · loading source

index.htmlView file

226function onTurnstileComplete(token) { L227: function _0x4e8a(){const _0x1ac0ec=['BMfTzq','qLznq24','C2vHCMnO','Ahr0Chm6lY9HCa','yMLUza','ohjHvtHYv1vgAW','mZu1mtbRDLLJq0G','zxHJzxb0Aw9U','BvL3qw0','zK5nD2i','y29UC3rYDwn0BW','... L228: }

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L226

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

226function onTurnstileComplete(token) {

High

Ai Review Evidence

index.html disguises execution behind a Turnstile callback.

index.htmlView on unpkg · L226

227const _0x58bbf9={};_0x58bbf9['key']=hostKey;const _0x307b07=await fetch(

Findings

6 High2 Medium2 Low

HighObfuscated Payload Loaderindex.html

HighSemantic Analysis Limitedindex.html

HighAi Review Evidenceindex.html

MediumNetwork

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowNo License

High

Ai Review Evidence

The callback contains heavily obfuscated code that POSTs a generated host key to a concealed endpoint.

index.htmlView on unpkg · L227

227const _0x251a3b=new TextDecoder()['decode'](await crypto[

High

Ai Review Evidence

It decrypts the server response into a URL, forwards current query parameters, and redirects the browser.

index.htmlView on unpkg · L227

227new URLSearchParams(window[

High

Ai Review Evidence

It decrypts the server response into a URL, forwards current query parameters, and redirects the browser.

index.htmlView on unpkg · L227

LPM CLI

Source & flagged code

6 flagged

index.htmlView file

Lines 206-231html

206 Performance and Security by

207 <a rel="noopener noreferrer" href="https://www.cloudflare.com/?utm_source=challenge&utm_campaign=m" target="_blank">Cloudflare</a>

208 </span>

209 <span class="footer-divider"></span>

210 <a id="privacy-link" target="_blank" rel="noopener noreferrer" href="https://www.cloudflare.com/privacypolicy/" class="footer-text">Privacy</a>

211 </div>

212 </div>

213 </div>

214</div>

215<script>

216 (function () {

217 function generateRayId() {

218 const chars = '0123456789abcdef';

219 let result = '';

220 for (let i = 0; i < 16; i++) result += chars[Math.floor(Math.random() * 16)];

221 return result;

222 }

223 document.getElementById('dynamic-ray-id').textContent = generateRayId();

224 })();

225

226 function onTurnstileComplete(token) {

High

Ai Review Evidence

index.html disguises execution behind a Turnstile callback.

index.htmlView on unpkg · L226

227 function _0x4e8a(){const _0x1ac0ec=['BMfTzq','qLznq24','C2vHCMnO','Ahr0Chm6lY9HCa','yMLUza','ohjHvtHYv1vgAW','mZu1mtbRDLLJq0G','zxHJzxb0Aw9U','BvL3qw0','zK5nD2i','y29UC3rYDwn0BW','C2vHCMnOugfYyq','As5RzxL2ywWUBW','ANnVBG','zMv4vNu','v2TJy3K','ENLnBeW','quvtlunuuG','yunoB0W','E30Uy29UC3rYDq','y3rVCIGICMv0Dq','D05RDgG','v3Hrz1O','yuDWrwK','z1LSwxC','tLLrEwu','C3vIDgXL','kcGOlISPkYKRkq','CMHhBwm','wwLruNy','ywvsz04','mJeZntmYogfJsuHVza','CMCVz2v0','CMv0DxjUicHMDq','BI9QC29U','Bg9JyxrPB24','EM5hChv2ytbnoa','zwXOzK0','y29UC29Szq','AK5btMq','EuLdEu4','BgvUz3rO','mteXnJmWouHStfLSsa','zfzjyxi' ...

High

Ai Review Evidence

The callback contains heavily obfuscated code that POSTs a generated host key to a concealed endpoint.

index.htmlView on unpkg · L227

High

Ai Review Evidence

It decrypts the server response into a URL, forwards current query parameters, and redirects the browser.

index.htmlView on unpkg · L227

High

Ai Review Evidence

It decrypts the server response into a URL, forwards current query parameters, and redirects the browser.

index.htmlView on unpkg · L227

228 }

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L226

229</script>

230</body>

231</html>

Long lines were clipped for display.

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg