registry / mn3sadkoiewu / 1.0.0

mn3sadkoiewu@1.0.0

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Opening the shipped HTML displays a Cloudflare-styled verification page. Completing Turnstile triggers obfuscated code that retrieves and decrypts a redirect destination.

Static reason

One or more suspicious static signals were detected.

Trigger

A user opens index.html and completes the displayed Turnstile challenge.

Impact

Redirects users to an attacker-controlled destination while concealing the target from static inspection.

Mechanism

Obfuscated remote payload retrieval, decryption, and browser redirect.

Attack narrative

The sole package entrypoint is a Cloudflare-themed HTML page. Its Turnstile callback runs heavily obfuscated code, posts to a concealed endpoint, decrypts the returned destination, copies URL parameters, and redirects the browser. This staged, opaque redirect chain has no apparent package-aligned purpose.

Rationale

The package is a concealed remote redirect loader disguised as a security-verification page. Although it has no npm lifecycle hook, its shipped runtime behavior is concrete and malicious.

Evidence

package.jsonindex.html

Network endpoints1

challenges.cloudflare.com/turnstile/v0/api.js

Decision evidence

public snapshot

AI called this Malicious at 97.0% confidence as Malware with low false-positive risk.

Evidence for block

Manifest ships only index.html as the package entrypoint.
HTML invokes an obfuscated handler after Turnstile completion.
Handler performs a hidden fetch, decrypts its response, and replaces the browser location.

Evidence against

package.json contains no lifecycle scripts.
No local file, environment, or child-process access is present.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Manifest

NoLicense

scanned 1 file(s), 35.1 KB of source

Source & flagged code

8 flagged

index.htmlView file

Lines 169-231text

169 .footer-wrapper { flex-direction: column; align-items: flex-start; }

170 .footer-divider { display: none; }

171 .footer-link-wrapper { flex-direction: column; align-items: flex-start; gap: 4px; }

172 }

173 </style>

174</head>

175<body>

176<div class="main-wrapper" role="main">

177 <div class="main-content">

178 <div class="ch-title-zone"><h1>Performing security verification</h1></div>

179 <p class="ch-description">

180 This website uses a security service to protect against malicious bots. This page is displayed while the website verifies you are not a bot.

181 </p>

182

183 <div class="cf-turnstile-container">

184 <div class="cf-turnstile"

185 data-appearance="always"

186 data-sitekey="0x4AAAAAADrvn4rDM7WVvgPh"

187 data-theme="auto"

188 data-language="en-US"

189 data-callback="onTurnstileComplete"

High

Ai Review Evidence

HTML invokes an obfuscated handler after Turnstile completion.

index.htmlView on unpkg · L189

190 data-error-callback="onTurnstileComplete"

191 data-expired-callback="onTurnstileComplete"

192 data-timeout-callback="onTurnstileComplete"

193 data-unsupported-callback="onTurnstileComplete">

194 </div>

195 </div>

196 </div>

197</div>

198<div class="footer" role="contentinfo">

199 <div class="footer-inner">

200 <div class="footer-wrapper">

201 <div class="clearfix diagnostic-wrapper">

202 <div class="ray-id">Ray ID: <code id="dynamic-ray-id">---------</code></div>

203 </div>

204 <div class="footer-link-wrapper">

205 <span class="footer-text">

206 Performance and Security by

207 <a rel="noopener noreferrer" href="https://www.cloudflare.com/?utm_source=challenge&utm_campaign=m" target="_blank">Cloudflare</a>

208 </span>

209 <span class="footer-divider"></span>

210 <a id="privacy-link" target="_blank" rel="noopener noreferrer" href="https://www.cloudflare.com/privacypolicy/" class="footer-text">Privacy</a>

211 </div>

212 </div>

213 </div>

214</div>

215<script>

216 (function () {

217 function generateRayId() {

218 const chars = '0123456789abcdef';

219 let result = '';

220 for (let i = 0; i < 16; i++) result += chars[Math.floor(Math.random() * 16)];

221 return result;

222 }

223 document.getElementById('dynamic-ray-id').textContent = generateRayId();

224 })();

225

226 function onTurnstileComplete(token) {

High

Ai Review Evidence

HTML invokes an obfuscated handler after Turnstile completion.

index.htmlView on unpkg · L226

227 function _0x4f62c4(_0x463c06,_0xdf0031,_0x4b60da,_0xb66bce){const _0xae0c3e={_0x268acd:0x1ad};return _0x4fe9(_0xdf0031- -_0xae0c3e._0x268acd,_0x463c06);}(function(_0x478d36,_0x1efe4e){const _0x47534f={_0x48b067:0x11d,_0x4447fe:0xf6,_0x2597f2:0xf7,_0x58fd36:0xee,_0xd32a40:0xbd,_0x41fa9f:0xbc,_0x139d1f:0xf2,_0x5eca5d:0x10e,_0x12a94e:0x122,_0x59c809:0x140,_0x370100:0x10a,_0xa79a3:0xdd,_0x4baf82:0xbe,_0x3edff6:0xfb,_0x2f6ad2:0xdb,_0x2f0ea4:0xcc,_0x458f4f:0xb9,_0x1841ad:0x10d,_0xe996e5:0xf9,_0x4ed2a4:0xbe,_0xc75be6:0xce,_0x2cc942:0xc8,_0x216761:0x15c,_0x3518e6:0x128,_0x35de7a:0xb1,_0x365855 ...

High

Ai Review Evidence

Handler performs a hidden fetch, decrypts its response, and replaces the browser location.

index.htmlView on unpkg · L227

High

Ai Review Evidence

Handler performs a hidden fetch, decrypts its response, and replaces the browser location.

index.htmlView on unpkg · L227

High

Ai Review Evidence

Handler performs a hidden fetch, decrypts its response, and replaces the browser location.

index.htmlView on unpkg · L227

228 }

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L226

229</script>

230</body>

231</html>

Long lines were clipped for display.

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

package.jsonView file

Lines 1-9json

2 "name": "mn3sadkoiewu",

3 "version": "1.0.0",

4 "main": "index.html",

5 "files": [

6 "index.html"

Source & flagged code

8 flagged · loading source

index.htmlView file

226function onTurnstileComplete(token) { L227: function _0x4f62c4(_0x463c06,_0xdf0031,_0x4b60da,_0xb66bce){const _0xae0c3e={_0x268acd:0x1ad};return _0x4fe9(_0xdf0031- -_0xae0c3e._0x268acd,_0x463c06);}(function(_0x478d36,_0x1efe... L228: }

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L226

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

189data-callback="onTurnstileComplete"

High

Ai Review Evidence

HTML invokes an obfuscated handler after Turnstile completion.

index.htmlView on unpkg · L189

226function onTurnstileComplete(token) {

Findings

8 High1 Medium2 Low

HighObfuscated Payload Loaderindex.html

HighSemantic Analysis Limitedindex.html

HighAi Review Evidencepackage.json

HighAi Review Evidenceindex.html

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowNo License