registry / Credential exfiltration / mnhdjoweuq
mnhdjoweuq
This report shows the evidence for mnhdjoweuq@1.0.0, the only known version.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiSource inspection confirms a concealed redirect to a Microsoft-lookalike domain, not a benign package function. Absence of install hooks does not mitigate the browser phishing payload.
Static reason
No blocking static signals were detected.
Trigger
A user opens index.html and the Turnstile callback fires.
Impact
Can direct users to an attacker-controlled credential-phishing site and leak URL parameters.
Mechanism
Obfuscated phishing redirect with query-parameter forwarding.
Attack narrative
The sole package payload is an HTML page styled as a Cloudflare verification screen. Its obfuscated callback constructs https://login.microsofte.live/, forwards every current query parameter, and replaces the browser location. The deceptive Microsoft-lookalike destination and concealment establish a concrete phishing chain.
AI rationale
Source inspection confirms a concealed redirect to a Microsoft-lookalike domain, not a benign package function. Absence of install hooks does not mitigate the browser phishing payload.
Evidence
package.jsonindex.html
Network endpoints2
login.microsofte.live/challenges.cloudflare.com/turnstile/v0/api.js
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.html uses a fake Cloudflare verification page.
- onTurnstileComplete deobfuscates https://login.microsofte.live/.
- Callback copies all current URL query parameters to that lookalike domain.
- Callback redirects browser via window.location.replace.
- package.json exposes index.html as the package entrypoint.
Evidence against
- No npm lifecycle scripts are declared.
- No local file or environment harvesting was found.
Behavioral surface
NoLicense
Source & flagged code
1 flagged · loading sourcepackage.jsonView file
•Published source reference
High
Ai Review Evidence
package.json exposes index.html as the package entrypoint.
package.jsonView on unpkgFindings
5 High1 Low
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidencepackage.json
LowNo License
Affected versions and remediation
This report applies to mnhdjoweuq@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing mnhdjoweuq@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.