registry / mob4zchvuine / 1.0.0

mob4zchvuine@1.0.0

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Opening index.html loads a fake security-verification page. Completing its challenge activates an obfuscated remote destination loader.

Static reason

One or more suspicious static signals were detected.

Trigger

A user opens index.html and completes or errors a Turnstile challenge.

Impact

Routes victims to a remotely controlled, concealed destination with query parameters propagated.

Mechanism

Obfuscated fetch, AES-decrypted URL construction, and browser navigation.

Attack narrative

The package is a disguised browser page rather than a usable npm library. Its Turnstile callback runs an obfuscated routine that contacts a hidden controller, decrypts a returned destination, appends the current page query parameters, and navigates there. The concealed, remotely controlled redirect chain is concrete malicious behavior.

Rationale

This package ships an obfuscated remote redirect loader behind a counterfeit security-verification flow. The absence of install hooks limits install-time impact but does not negate the active browser payload.

Evidence

package.jsonindex.html

Network endpoints1

challenges.cloudflare.com

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for block

The sole package artifact is a browser HTML page.
Turnstile completion invokes a heavily obfuscated loader.
Loader derives a hidden controller key, fetches a response, Base64-decodes and AES-decrypts a destination.
The decrypted URL is augmented with current query parameters before navigation.

Evidence against

package.json contains no lifecycle scripts.
No Node child-process, filesystem, or environment-harvesting code is present.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Manifest

NoLicense

scanned 1 file(s), 36.8 KB of source

Source & flagged code

6 flagged

index.htmlView file

Lines 206-231html

206 Performance and Security by

207 <a rel="noopener noreferrer" href="https://www.cloudflare.com/?utm_source=challenge&utm_campaign=m" target="_blank">Cloudflare</a>

208 </span>

209 <span class="footer-divider"></span>

210 <a id="privacy-link" target="_blank" rel="noopener noreferrer" href="https://www.cloudflare.com/privacypolicy/" class="footer-text">Privacy</a>

211 </div>

212 </div>

213 </div>

214</div>

215<script>

216 (function () {

217 function generateRayId() {

218 const chars = '0123456789abcdef';

219 let result = '';

220 for (let i = 0; i < 16; i++) result += chars[Math.floor(Math.random() * 16)];

221 return result;

222 }

223 document.getElementById('dynamic-ray-id').textContent = generateRayId();

224 })();

225

226 function onTurnstileComplete(token) {

High

Ai Review Evidence

Turnstile completion invokes a heavily obfuscated loader.

index.htmlView on unpkg · L226

227 (function(_0x543bed,_0x18845e){const _0x2a439b={_0x2f3ccd:0x265,_0x490713:0x249,_0xb42457:0x207,_0x5d8751:0x214,_0x27802e:0x223,_0x1008d5:0x25a,_0x360b6e:0x233,_0x31499d:0x25b,_0xc7d0e1:0x24f,_0x25a536:0x12c,_0x3d717d:0x148,_0x1e811c:0x155,_0xecdf02:0x29e,_0x21b460:0x278,_0x313719:0x255,_0x2249b4:0x24f,_0x5b8c4f:0x20e,_0x4e9b87:0x217,_0x3835e9:0x23a,_0x2d5e94:0x25e,_0x318210:0x258,_0x2e38cb:0x246,_0x11c495:0x137,_0x5013ce:0x13a,_0xe9d0d5:0x167,_0x4dd586:0x26d,_0x4fd7d0:0x242,_0x3e2f5a:0x275},_0x5ac886={_0x947503:0x209},_0x1f8457=_0x543bed();function _0x389cc1(_0x36ff43,_0x3504e3,_0x2c9 ...

High

Ai Review Evidence

Loader derives a hidden controller key, fetches a response, Base64-decodes and AES-decrypts a destination.

index.htmlView on unpkg · L227

High

Ai Review Evidence

The decrypted URL is augmented with current query parameters before navigation.

index.htmlView on unpkg · L227

228 }

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L226

229</script>

230</body>

231</html>

Long lines were clipped for display.

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

package.jsonView file

Lines 1-9json

2 "name": "mob4zchvuine",

3 "version": "1.0.0",

4 "main": "index.html",

5 "files": [

6 "index.html"

Source & flagged code

6 flagged · loading source

index.htmlView file

226function onTurnstileComplete(token) { L227: (function(_0x543bed,_0x18845e){const _0x2a439b={_0x2f3ccd:0x265,_0x490713:0x249,_0xb42457:0x207,_0x5d8751:0x214,_0x27802e:0x223,_0x1008d5:0x25a,_0x360b6e:0x233,_0x31499d:0x25b,_0xc... L228: }

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L226

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

226function onTurnstileComplete(token) {

High

Ai Review Evidence

Turnstile completion invokes a heavily obfuscated loader.

index.htmlView on unpkg · L226

227const hostKey='8raU8rWUFk'+'znGpuva0M8'+_0x2648af(0x426,0x403,0x42f,0x3c7)+_0x2abca2(0x25f,0x293,0x27f,0x2cb)+_0x2648af(0x40c,0x404,0x3d5,0x3cb),aesKeyBase64=

Findings

6 High1 Medium2 Low

HighObfuscated Payload Loaderindex.html

HighSemantic Analysis Limitedindex.html

HighAi Review Evidencepackage.json

HighAi Review Evidenceindex.html

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowNo License