registry / nottuff6 / 2.0.0

nottuff6@2.0.0

Republished package

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Opening the packaged `index.html` executes JavaScript supplied by an unrelated remote host. The page also installs a service worker and configures a browser proxy WebSocket.

Static reason

One or more suspicious static signals were detected.

Trigger

A user opens `index.html` or serves the packaged web application.

Impact

The remote host can run arbitrary browser-side code in the page origin; the service worker can intercept routed requests.

Mechanism

Remote script execution plus service-worker-backed proxy routing.

Attack narrative

The package is a disguised, obfuscated browser application rather than a normal npm library. On opening its declared HTML entrypoint, it imports executable JavaScript from `c.vipersfutbol.com`; that host can change the payload without republishing the package. The local application concurrently registers a service worker that intercepts routed fetches and initializes a proxy transport to `wss://21baseballacademy.com/fairs/`. These unrelated remote control points, combined with heavy obfuscation and inconsistent package identity, form a concrete remote-payload execution chain.

Rationale

No install hook runs, but the declared entrypoint immediately delegates code execution to an unrelated remote domain and sets up persistent browser request interception. That is concrete malicious behavior for a republished npm package.

Evidence

package.jsonindex.htmlassets/boot-CVPGRFHh.jsj6k3y8.jsct1tl/pap3do.jsassets/proxy-runtime-1NyFshf9.jsassets/ChatPage-zoA8Z6RX.jsct1tl/csbzam.jsct1tl/jmqwjq.jsbfjdx/757lr8.jsbfjdx/w7m632.wasmassets/index-CJm_PfL2.js

Network endpoints3

c.vipersfutbol.com/script.jswww.googletagmanager.com/gtag/js?id=G-0VL3ZSBXDHwss://21baseballacademy.com/fairs/

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for block

`index.html` loads executable remote script from `c.vipersfutbol.com` on page open.
`assets/boot-CVPGRFHh.js` registers `j6k3y8.js` as a service worker.
`j6k3y8.js` intercepts matching fetches and routes them through bundled proxy code.
`assets/boot-CVPGRFHh.js` opens a Wisp WebSocket to `21baseballacademy.com`.
Core application bundles, including `assets/ChatPage-zoA8Z6RX.js`, are deliberately obfuscated.
Package identity is inconsistent: `nottuff6` ships a page titled `Lucide` plus unrelated sports domains.

Evidence against

`package.json` has no preinstall, install, or postinstall hook.
No inspected source showed Node child-process execution or local credential-file harvesting.

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemNetworkWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

Manifest

NoLicense

scanned 24 file(s), 7.27 MB of source, external domains: 127.0.0.1, aomediacodec.github.io, cdn.jsdelivr.net, cloud-api.livekit.io, curl.se, emscripten.org, fingerprint.com, github.com, m1.openfpcdn.io, react.dev, sj-cache.invalid, twemoji.maxcdn.com, www.w3.org, www.zlib.net

Source & flagged code

7 flagged

assets/proxy-runtime-1NyFshf9.jsView file

1patternName = aws_access_key severity = critical line = 1 matchedText = var OQ=O...B+=`

Critical

Critical Secret

Package contains a critical-looking secret pattern.

assets/proxy-runtime-1NyFshf9.jsView on unpkg · L1

1patternName = aws_access_key severity = critical line = 1 matchedText = var OQ=O...B+=`

Critical

Secret Pattern

AWS access key ID in assets/proxy-runtime-1NyFshf9.js

assets/proxy-runtime-1NyFshf9.jsView on unpkg · L1

bfjdx/757lr8.jsView file

Lines 1-31javascript

1(()=>{let e,t;var r,i,n,s,o,a,A={8770(e,t,r){var i={"./":"6418","./client":"6039","./client.ts":"6039","./dom/attr":"8806","./dom/attr.ts":"8806","./dom/beacon":"7265","./dom/beacon.ts":"7265","./dom/cookie":"8227","./dom/cookie.ts":"8227","./dom/css":"8114","./dom/css.ts":"8114","./dom/document":"6820","./dom/document.ts":"6820","./dom/element":"1733","./dom/element.ts":"1733","./dom/fontface":"737","./dom/fontface.ts":"737","./dom/fragments":"2452","./dom/fragments.ts":"2452","./dom/history":"4397","./dom/history.ts":"4397","./dom/open":"5421","./dom/open.ts":"5421","./dom/origin":"8703","./ ...

3// SCRAMJET FUNCTION INTERCEPT

4// target: ${e}

5// frame: ${r}

6// location: ${s}

8function apply(fn, that, args) {

9 return Reflect.apply(fn, that, args);

10}

12function construct(fn, args, newTarget) {

13 return Reflect.construct(fn, args, newTarget);

14}

16return { apply, construct };

18//# sourceURL=${A}`)();n=c,o=l}else n=g.z$,o=g.Mt;r.construct&&(l.construct=function(e,t,i){let n,s=!1,a={fn:e,this:null,args:t,newTarget:i,return:e=>{s=!0,n=e},call:()=>(s=!0,n=o(a.fn,a.args,a.newTarget))};return(r.construct(a),s)?n:o(a.fn,a.args,a.newTarget)}),r.apply&&(l.apply=(e,t,i)=>{let s,o=!1,a={fn:e,this:t,args:i,newTarget:null,return:e=>{o=!0,s=e},call:()=>(o=!0,s=n(a.fn,a.this,a.args))};if(!this.flagEnabled("debugTrampolines")&&this.flagEnabled("allowFailedIntercepts"))return(r.apply(a),o)?s:n(a.fn,a.this,a.args);let A=g.$D.prepareStackTrace,l=this;g.$D.prepareStackTrace=function(e, ...

19//# sourceURL=${r.url.href}`),n}return o.body;case"style":return(0,i.sM)(await o.text(),e.context,r.meta);case"sharedworker":case"worker":return(0,i.iP)(new Uint8Array(await o.arrayBuffer()),o.url,e.context,r.meta,r.isModule);default:return o.body}}},6967(e,t,r){r.d(t,{A4:()=>u});var i=r(3235),n=r(5657),s=r(7492),o=r(4e3),a=r(2967),A=r(7959),l=r(3129),c=r(49),h=r(5994);async function u(e,t){var r;let i,u=(0,s.T)(t,e);if("blob:"===(r=u.url).protocol||"data:"===r.protocol)return d(e,t,u);let m={};if(await l.C.dispatch(e.hooks.fetch.intercept,{request:t,parsed:u},m),m.response)return m.response;i ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bfjdx/757lr8.jsView on unpkg · L17

20 background-color: ${{log:"#000",warn:"#f80",error:"#f00",debug:"transparent"}[e]};

21 color: ${{log:"#fff",warn:"#fff",error:"#fff",debug:"gray"}[e]};

22 padding: ${{log:2,warn:4,error:4,debug:0}[e]}px;

23 font-weight: bold;

24 font-family: monospace;

25 font-size: 0.9em;

26 `,`${"debug"===e?"color: gray":""}`,...i)},log:function(e,...t){this.fmt("log",e,...t)},warn:function(e,...t){this.fmt("warn",e,...t)},error:function(e,...t){this.fmt("error",e,...t)},debug:function(e,...t){this.fmt("debug",e,...t)},time(e,t,r){let n,s=(0,i.wU)()-t;n=s<1?"BLAZINGLY FAST":s<500?"decent speed":"really slow",this.print("debug","[time]",`${r} was ${n} (${s.toFixed(2)}ms)`)}}},6372(e,t,r){r.d(t,{c:()=>s});var i=r(5994),n=r(2075);class s{cookies={};byDomain=new Map;defaultPath(e){let t=e.pathname;if(!t||!t.startsWith("/"))return"/";let r=t.lastIndexOf("/");return r<=0?"/":t.slice( ...

27${e}`):`${e}

28${c}`}}if((0,i.U5)("rewriterLogs",r,n.base))for(let e of A.errors)o.error("oxc parse error",e);return c}catch(a){if(o.warn("failed rewriting js for",t||"(unknown)",a.message,"string"!=typeof e?(0,s.hS)(e):e),(0,i.U5)("allowInvalidJs",r,n.base))return e;throw a}}Error.stackTraceLimit=50},

29`:`importScripts("${e}");

30`,c=r.interface.getWorkerInjectScripts(a,A,l),h=(0,n.o)(e,t,r,a,A);if("string"!=typeof h&&(h=(0,s.hS)(h)),(0,i.U5)("encapsulateWorkers",r,a.origin)){let e;h+=`//# sourceURL=${t}`,c+=l((e=h,`data:text/javascript;charset=utf-8;base64,${(0,o.K)(e)}`))}else c+=h;return c}},2075(e,t,r){r.d(t,{Ay:()=>o});let i=new TextEncoder;function n(e){return"string"==typeof e&&!!e.trim()}function s(e){for(let t=0;t<e.length;t++){let r=e.charCodeAt(t);if((r>=0&&r<=31||127===r)&&9!==r)return!0}return!1}let o=function(e){return n(e)?[e].map(e=>(function(e){var t,r,o;let a,A,l,c=e.split(";"),h=c.shift();if(!h||!h.t ...

31//# sourceMappingURL=scramjet.js.map

Long lines were clipped for display.

assets/ChatPage-zoA8Z6RX.jsView file

1(function(_0x31bba3,_0x379132){const _0x159e7b={_0x26fc34:0x358,_0x56fc24:0x70c,_0x216b69:0x578,_0x22d6fc:0x60b,_0x33af41:0x2a6,_0x514b56:0x7f9,_0x4ccc4c:0x9d1,_0x35dd24:0xfdf,_0x1...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

assets/ChatPage-zoA8Z6RX.jsView on unpkg · L1

bfjdx/w7m632.wasmView file

•path = bfjdx/w7m632.wasm kind = wasm_module sizeBytes = 586279 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

bfjdx/w7m632.wasmView on unpkg

assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

assets/livekit-C0E_jLSz.jsView file

13patternName = generic_password severity = medium line = 13 matchedText = `},e.par...+`\r

Medium

Secret Pattern

Hardcoded password in assets/livekit-C0E_jLSz.js

assets/livekit-C0E_jLSz.jsView on unpkg · L13

Source & flagged code

7 flagged · loading source

assets/proxy-runtime-1NyFshf9.jsView file

1patternName = aws_access_key severity = critical line = 1 matchedText = var OQ=O...B+=`

Critical

Critical Secret

Package contains a critical-looking secret pattern.

assets/proxy-runtime-1NyFshf9.jsView on unpkg · L1

1patternName = aws_access_key severity = critical line = 1 matchedText = var OQ=O...B+=`

Critical

Secret Pattern

AWS access key ID in assets/proxy-runtime-1NyFshf9.js

assets/proxy-runtime-1NyFshf9.jsView on unpkg · L1

bfjdx/757lr8.jsView file

17L18: //# sourceURL=${A}`)();n=c,o=l}else n=g.z$,o=g.Mt;r.construct&&(l.construct=function(e,t,i){let n,s=!1,a={fn:e,this:null,args:t,newTarget:i,return:e=>{s=!0,n=e},call:()=>(s=!0,n=o(... L19: //# sourceURL=${r.url.href}`),n}return o.body;case"style":return(0,i.sM)(await o.text(),e.context,r.meta);case"sharedworker":case"worker":return(0,i.iP)(new Uint8Array(await o.arra...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bfjdx/757lr8.jsView on unpkg · L17

assets/ChatPage-zoA8Z6RX.jsView file

1(function(_0x31bba3,_0x379132){const _0x159e7b={_0x26fc34:0x358,_0x56fc24:0x70c,_0x216b69:0x578,_0x22d6fc:0x60b,_0x33af41:0x2a6,_0x514b56:0x7f9,_0x4ccc4c:0x9d1,_0x35dd24:0xfdf,_0x1...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

assets/ChatPage-zoA8Z6RX.jsView on unpkg · L1

bfjdx/w7m632.wasmView file

•path = bfjdx/w7m632.wasm kind = wasm_module sizeBytes = 586279 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

bfjdx/w7m632.wasmView on unpkg

assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

assets/livekit-C0E_jLSz.jsView file

13patternName = generic_password severity = medium line = 13 matchedText = `},e.par...+`\r

Medium

Secret Pattern

Hardcoded password in assets/livekit-C0E_jLSz.js

assets/livekit-C0E_jLSz.jsView on unpkg · L13

Findings

2 Critical3 High6 Medium4 Low

CriticalCritical Secretassets/proxy-runtime-1NyFshf9.js

CriticalSecret Patternassets/proxy-runtime-1NyFshf9.js

HighObfuscated Payload Loaderassets/ChatPage-zoA8Z6RX.js

HighObfuscated

HighShips High Entropy Blobassets/KaTeX_Script-Regular-D3wIWfF6.woff2

MediumDynamic Requirebfjdx/757lr8.js

MediumNetwork

MediumProtestware

MediumShips Wasm Modulebfjdx/w7m632.wasm

MediumStructural Risk Force Deep Review

MediumSecret Patternassets/livekit-C0E_jLSz.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

7 flagged

assets/proxy-runtime-1NyFshf9.jsView file

1patternName = aws_access_key severity = critical line = 1 matchedText = var OQ=O...B+=`

Critical

Critical Secret

Package contains a critical-looking secret pattern.

assets/proxy-runtime-1NyFshf9.jsView on unpkg · L1

1patternName = aws_access_key severity = critical line = 1 matchedText = var OQ=O...B+=`

Critical

Secret Pattern

AWS access key ID in assets/proxy-runtime-1NyFshf9.js

assets/proxy-runtime-1NyFshf9.jsView on unpkg · L1

bfjdx/757lr8.jsView file

Lines 1-31javascript

3// SCRAMJET FUNCTION INTERCEPT

4// target: ${e}

5// frame: ${r}

6// location: ${s}

8function apply(fn, that, args) {

9 return Reflect.apply(fn, that, args);

10}

12function construct(fn, args, newTarget) {

13 return Reflect.construct(fn, args, newTarget);

14}

16return { apply, construct };

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bfjdx/757lr8.jsView on unpkg · L17

20 background-color: ${{log:"#000",warn:"#f80",error:"#f00",debug:"transparent"}[e]};

21 color: ${{log:"#fff",warn:"#fff",error:"#fff",debug:"gray"}[e]};

22 padding: ${{log:2,warn:4,error:4,debug:0}[e]}px;

23 font-weight: bold;

24 font-family: monospace;

25 font-size: 0.9em;

27${e}`):`${e}

29`:`importScripts("${e}");

31//# sourceMappingURL=scramjet.js.map

Long lines were clipped for display.

assets/ChatPage-zoA8Z6RX.jsView file

1(function(_0x31bba3,_0x379132){const _0x159e7b={_0x26fc34:0x358,_0x56fc24:0x70c,_0x216b69:0x578,_0x22d6fc:0x60b,_0x33af41:0x2a6,_0x514b56:0x7f9,_0x4ccc4c:0x9d1,_0x35dd24:0xfdf,_0x1...

High

Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

assets/ChatPage-zoA8Z6RX.jsView on unpkg · L1

bfjdx/w7m632.wasmView file

•path = bfjdx/w7m632.wasm kind = wasm_module sizeBytes = 586279 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

bfjdx/w7m632.wasmView on unpkg

assets/KaTeX_Script-Regular-D3wIWfF6.woff2View file

•path = assets/KaTeX_Script-Regular-D3wIWfF6.woff2 kind = high_entropy_blob sizeBytes = 9644 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

assets/KaTeX_Script-Regular-D3wIWfF6.woff2View on unpkg

assets/livekit-C0E_jLSz.jsView file

13patternName = generic_password severity = medium line = 13 matchedText = `},e.par...+`\r

Medium

Secret Pattern

Hardcoded password in assets/livekit-C0E_jLSz.js

assets/livekit-C0E_jLSz.jsView on unpkg · L13