registry / Remote code execution / nottuff14
nottuff14
Republished package
This report shows the evidence for nottuff14@2.0.0. 3 of 3 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is not merely a static hint: direct source inspection confirms an unconditional remote script execution path from the declared entrypoint. The lack of npm lifecycle hooks limits install-time impact but does not remove the concrete browser-time remote-code-execution risk.
Static reason
One or more suspicious static signals were detected.
Trigger
A user opens `index.html` or serves the package as a web app.
Impact
The remote host can execute arbitrary JavaScript in the page origin and access data available to that browser application.
Mechanism
Unpinned third-party script execution with browser proxy runtime.
Attack narrative
The declared entrypoint is an HTML application that automatically loads JavaScript from `c.vipersfutbol.com`; the package does not pin, verify, or bundle that code. Whoever controls that endpoint can change the payload after publication and execute it whenever the app is opened. The package also ships obfuscated browser bundles and a service-worker/proxy stack that supports request routing and cookie synchronization, increasing the impact of executing an unreviewable remote payload.
AI rationale
This is not merely a static hint: direct source inspection confirms an unconditional remote script execution path from the declared entrypoint. The lack of npm lifecycle hooks limits install-time impact but does not remove the concrete browser-time remote-code-execution risk.
Evidence
package.jsonindex.htmlct1tl/pap3do.jsct1tl/csbzam.jsassets/proxy-runtime-1NyFshf9.jsassets/ChatPage-zoA8Z6RX.jsassets/index-CJm_PfL2.jsbfjdx/w7m632.wasm
Network endpoints2
c.vipersfutbol.com/script.jswww.googletagmanager.com/gtag/js?id=G-0VL3ZSBXDH
Decision evidence
public snapshotAI called this Malicious at 90.0% confidence as Malware with low false-positive risk.
Evidence for block
- `index.html` unconditionally loads `https://c.vipersfutbol.com/script.js`.
- `index.html` is the declared `main` entrypoint.
- `assets/ChatPage-zoA8Z6RX.js` and `assets/index-CJm_PfL2.js` are heavily obfuscated.
- `ct1tl/pap3do.js` implements proxy/service-worker cookie and request routing.
- `assets/proxy-runtime-1NyFshf9.js` loads a bundled WebAssembly network runtime.
Evidence against
- `package.json` contains no preinstall, install, or postinstall hook.
- No Node filesystem, environment harvesting, or child-process behavior was found in the inspected entry path.
Behavioral surface
ChildProcessDynamicRequireFilesystemNetworkWebSocket
HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings
NoLicense
Source & flagged code
7 flagged · loading sourceassets/proxy-runtime-1NyFshf9.jsView file
1patternName = aws_access_key
severity = critical
line = 1
matchedText = var OQ=O...B+=`
Critical
Critical Secret
Package contains a critical-looking secret pattern.
assets/proxy-runtime-1NyFshf9.jsView on unpkg · L11patternName = aws_access_key
severity = critical
line = 1
matchedText = var OQ=O...B+=`
Critical
Secret Pattern
AWS access key ID in assets/proxy-runtime-1NyFshf9.js
assets/proxy-runtime-1NyFshf9.jsView on unpkg · L1bfjdx/757lr8.jsView file
17L18: //# sourceURL=${A}`)();n=c,o=l}else n=g.z$,o=g.Mt;r.construct&&(l.construct=function(e,t,i){let n,s=!1,a={fn:e,this:null,args:t,newTarget:i,return:e=>{s=!0,n=e},call:()=>(s=!0,n=o(...
L19: //# sourceURL=${r.url.href}`),n}return o.body;case"style":return(0,i.sM)(await o.text(),e.context,r.meta);case"sharedworker":case"worker":return(0,i.iP)(new Uint8Array(await o.arra...
Medium
Findings
2 Critical3 High6 Medium4 Low
CriticalCritical Secretassets/proxy-runtime-1NyFshf9.js
CriticalSecret Patternassets/proxy-runtime-1NyFshf9.js
HighObfuscated Payload Loaderassets/ChatPage-zoA8Z6RX.js
HighObfuscated
HighShips High Entropy Blobassets/KaTeX_Script-Regular-D3wIWfF6.woff2
MediumDynamic Requirebfjdx/757lr8.js
MediumNetwork
MediumProtestware
MediumShips Wasm Modulebfjdx/w7m632.wasm
MediumStructural Risk Force Deep Review
MediumSecret Patternassets/livekit-C0E_jLSz.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to nottuff14@2.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing nottuff14@2.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.