registry / Staged payload carrier / prezdentkxheiw
prezdentkxheiw
This report shows the evidence for prezdentkxheiw@1.0.0. 2 of 2 known versions are blocked or flagged. The newest version, 1.0.1, is blocked. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiAlthough it has no npm lifecycle hook, the declared entrypoint is an obfuscated fake-verification redirector with no package-aligned purpose. The concealed destination and query forwarding establish malicious browser behavior.
Static reason
No blocking static signals were detected.
Trigger
A user opens index.html and the Turnstile callback fires.
Impact
Can route users and supplied query data to an undisclosed remote destination.
Mechanism
Obfuscated query-preserving browser redirect behind a fake verification screen.
Attack narrative
The sole published payload masquerades as a Cloudflare security-verification page. Its challenge callback uses obfuscated code to build a hidden remote URL, appends every current query parameter, and replaces the browser location. This is a concealed redirector rather than a legitimate npm library and can support phishing or staged payload delivery.
AI rationale
Although it has no npm lifecycle hook, the declared entrypoint is an obfuscated fake-verification redirector with no package-aligned purpose. The concealed destination and query forwarding establish malicious browser behavior.
Evidence
package.jsonindex.html
Network endpoints1
challenges.cloudflare.com/turnstile/v0/api.js
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.html is a fake Cloudflare verification page.
- The Turnstile callback contains heavily obfuscated, self-defending JavaScript.
- Callback constructs a fixed hidden URL, copies current query parameters, then calls window.location.replace.
- The package name is unrelated to the embedded browser payload.
Evidence against
- package.json has no lifecycle scripts, bin, or dependencies.
- No filesystem, environment, child-process, or npm install-time behavior is present.
Behavioral surface
NoLicense
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
4 High1 Low
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
LowNo License
Affected versions and remediation
This report applies to prezdentkxheiw@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing prezdentkxheiw@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.