mxckjdgweuxpsiohd@1.0.0
AI Security Review
scanned 9d ago · by lpm-firewall-aiThe shipped entrypoint combines a deceptive verification page with opaque remote policy retrieval and automatic browser redirection. This is active redirect behavior, so the package should be blocked.
Static reason
One or more suspicious static signals were detected.
Trigger
A visitor loads the page; the redirect routine is also connected to the challenge completion callback.
Impact
Visitors can be routed to a remotely selected page without the destination being apparent from the package source.
Mechanism
The script contacts concealed policy services, decrypts a returned URL, fetches a visitor-specific redirect policy, and replaces the browser location with the selected destination.
Attack narrative
The package entrypoint displays a Cloudflare-style verification page while an obfuscated script retrieves and decrypts remote redirect configuration. It then fetches a visitor-specific policy and sends the browser to the selected destination. The controlling service and final destination are concealed in the script.
AI rationale
The shipped entrypoint combines a deceptive verification page with opaque remote policy retrieval and automatic browser redirection. This is active redirect behavior, so the package should be blocked.
Evidence
index.html
Network endpoints1
challenges.cloudflare.com/turnstile/v0/api.js
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- The manifest publishes index.html as the package entrypoint.
- The page presents a Cloudflare Turnstile challenge and connects its completion callback to a redirect routine.
- The obfuscated script sends a host key to a concealed endpoint and decrypts returned data into a URL.
- It fetches a remote redirect policy using a visitor-provided identifier, then applies the selected URL and replaces the page location.
Evidence against
Behavioral surface
Network
HighEntropyStringsMinifiedPossibleObfuscation
NoLicense
Source & flagged code
8 flagged · loading sourceindex.htmlView file
182}
L183: (function(_0x479721,_0x1db775){const _0x5d2f37={_0x3c1cb8:0x94,_0x2f22f7:0x2a,_0x271fa9:0x77,_0x62e0d4:0x7,_0x5c6fd4:0x43,_0x30638f:0xab,_0xaca117:0x3c,_0x3bb054:0x26,_0xa26e5a:0x2...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
index.htmlView on unpkg · L182•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
index.htmlView on unpkg179if (window.__challengeRedirect) {
window.__challengeRedirect();
}
}
(function(_
High
Ai Review Evidence
The page presents a Cloudflare Turnstile challenge and connects its completion callback to a redirect routine.
index.htmlView on unpkg · L17910
Findings
8 High2 Medium2 Low
HighObfuscated Payload Loaderindex.html
HighSemantic Analysis Limitedindex.html
HighAi Review Evidencepackage.json
HighAi Review Evidenceindex.html
HighAi Review Evidenceindex.html
HighAi Review Evidenceindex.html
HighAi Review Evidenceindex.html
HighAi Review Evidenceindex.html
MediumNetwork
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowNo License
Affected versions and remediation
This report applies to mxckjdgweuxpsiohd@1.0.0.
See all versions of mxckjdgweuxpsiohd for other recorded verdicts.
- Avoid installing mxckjdgweuxpsiohd@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.