registry / mnhdjoweuq / 1.0.0

mnhdjoweuq@1.0.0

AI Security Review

scanned 9d ago · by lpm-firewall-ai

Opening the package HTML presents a verification lure and redirects to a Microsoft-lookalike domain. The redirect forwards URL query parameters.

Static reason

No blocking static signals were detected.

Trigger

A user opens index.html and the Turnstile callback fires.

Impact

Can direct users to an attacker-controlled credential-phishing site and leak URL parameters.

Mechanism

Obfuscated phishing redirect with query-parameter forwarding.

Attack narrative

The sole package payload is an HTML page styled as a Cloudflare verification screen. Its obfuscated callback constructs https://login.microsofte.live/, forwards every current query parameter, and replaces the browser location. The deceptive Microsoft-lookalike destination and concealment establish a concrete phishing chain.

Rationale

Source inspection confirms a concealed redirect to a Microsoft-lookalike domain, not a benign package function. Absence of install hooks does not mitigate the browser phishing payload.

Evidence

package.jsonindex.html

Network endpoints2

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13822

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in mnhdjoweuq (npm)

Details

Package contains only package.json and index.html, with main pointing at the HTML file. index.html mimics a Cloudflare Turnstile 'Just a moment' challenge and contains an obfuscator.io-obfuscated Turnstile callback that reconstructs a URL starting with 'https://lo' from a string-array and navigates the browser to it via window.location. There are no install lifecycle scripts (preinstall/install/postinstall/prepare) and main is HTML rather than JavaScript, so nothing executes on npm install or require of the package. The obfuscated redirect only fires when a browser loads the HTML (for example if served via a CDN like unpkg/jsdelivr), affecting a browser visitor rather than the developer who installs the package. ## Source: ghsa-malware (170a3c304b39df4c6efaf25e1bf7537b125f1a0229693b201fdb4839a46e67cb) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

OSV advisory ADVISORY PACKAGE

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.html uses a fake Cloudflare verification page.
onTurnstileComplete deobfuscates https://login.microsofte.live/.
Callback copies all current URL query parameters to that lookalike domain.
Callback redirects browser via window.location.replace.
package.json exposes index.html as the package entrypoint.

Evidence against

No npm lifecycle scripts are declared.
No local file or environment harvesting was found.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 0 file(s), 0 B of source

Source & flagged code

1 flagged

package.jsonView file

•Published source reference

High

Ai Review Evidence

package.json exposes index.html as the package entrypoint.

package.jsonView on unpkg

Source & flagged code

1 flagged · loading source

package.jsonView file

•Published source reference

High

Ai Review Evidence

package.json exposes index.html as the package entrypoint.

package.jsonView on unpkg

Findings

5 High1 Low

HighAi Review Evidence

HighAi Review Evidencepackage.json

LowNo License