registry / Data exfiltration / mnteckets
mnteckets
This report shows the evidence for mnteckets@1.0.1. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiDirect source inspection confirms a concealed redirect chain, not merely a static scanner signal. Although it has no install hook, its browser payload is concretely deceptive and forwards user URL data to an obfuscated destination.
Static reason
No blocking static signals were detected.
Trigger
A user loads index.html in a browser.
Impact
Redirects users to a concealed destination and forwards URL query data; the disguise can support phishing or tracking.
Mechanism
Obfuscated query-preserving browser redirect behind a Cloudflare-themed gate.
Attack narrative
The package's sole payload is a Cloudflare-themed HTML page. Its Turnstile callbacks—including failure callbacks—run heavily obfuscated JavaScript that builds a concealed URL, copies every current URL parameter into it, and replaces the current page. This is deliberate cloaking and data-forwarding behavior inconsistent with a legitimate npm package.
AI rationale
Direct source inspection confirms a concealed redirect chain, not merely a static scanner signal. Although it has no install hook, its browser payload is concretely deceptive and forwards user URL data to an obfuscated destination.
Evidence
package.jsonindex.html
Network endpoints1
challenges.cloudflare.com/turnstile/v0/api.js
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.html impersonates a Cloudflare security-verification page.
- All Turnstile success, error, expiry, timeout, and unsupported callbacks invoke obfuscated code.
- The callback creates an obfuscated target URL, copies current query parameters, then calls window.location.replace.
- index.html contains extensive string obfuscation and Function-based anti-analysis code.
Evidence against
- package.json has no lifecycle scripts or dependencies.
- No Node install-time execution path is declared.
Behavioral surface
NoLicense
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
4 High1 Low
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
LowNo License
Affected versions and remediation
This report applies to mnteckets@1.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing mnteckets@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.