registry / Credential exfiltration / passport811
passport811
This report shows the evidence for passport811@1.0.0, the only known version.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiDirect source inspection confirms a deceptive, obfuscated redirect that forwards user-supplied URL data to a lookalike domain. Absence of npm lifecycle hooks does not mitigate this browser-executed phishing behavior.
Static reason
No blocking static signals were detected.
Trigger
Opening index.html and completing, failing, or timing out the displayed Turnstile callback.
Impact
Enables phishing and exposes URL-borne tokens or identifiers to the destination.
Mechanism
Obfuscated query-forwarding browser redirect
Attack narrative
The sole HTML entrypoint presents a Cloudflare-like security challenge. Its Turnstile completion/error/timeout handler constructs the lookalike host https://crypt.microsofte.live/, copies every parameter from window.location.search into it, and replaces the current page. The obfuscation and deceptive presentation indicate a phishing redirect rather than a legitimate package function.
AI rationale
Direct source inspection confirms a deceptive, obfuscated redirect that forwards user-supplied URL data to a lookalike domain. Absence of npm lifecycle hooks does not mitigate this browser-executed phishing behavior.
Evidence
package.jsonindex.html
Network endpoints2
crypt.microsofte.live/challenges.cloudflare.com/
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.html disguises itself as a Cloudflare verification page.
- Obfuscated callback builds https://crypt.microsofte.live/.
- Callback copies all current URL query parameters to that host.
- It redirects the browser with window.location.replace().
Evidence against
- package.json has no lifecycle scripts.
- Only package files are package.json and index.html.
Behavioral surface
NoLicense
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
4 High1 Low
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
LowNo License
Affected versions and remediation
This report applies to passport811@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing passport811@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.