registry / prezdentkxheiw / 1.0.0

prezdentkxheiw@1.0.0

AI Security Review

scanned 9d ago · by lpm-firewall-ai

Opening the declared HTML entrypoint presents a fake verification page. After the challenge callback, obfuscated code redirects the browser to a concealed external URL while preserving query parameters.

Static reason

No blocking static signals were detected.

Trigger

A user opens index.html and the Turnstile callback fires.

Impact

Can route users and supplied query data to an undisclosed remote destination.

Mechanism

Obfuscated query-preserving browser redirect behind a fake verification screen.

Attack narrative

The sole published payload masquerades as a Cloudflare security-verification page. Its challenge callback uses obfuscated code to build a hidden remote URL, appends every current query parameter, and replaces the browser location. This is a concealed redirector rather than a legitimate npm library and can support phishing or staged payload delivery.

Rationale

Although it has no npm lifecycle hook, the declared entrypoint is an obfuscated fake-verification redirector with no package-aligned purpose. The concealed destination and query forwarding establish malicious browser behavior.

Evidence

package.jsonindex.html

Network endpoints1

challenges.cloudflare.com/turnstile/v0/api.js

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13833

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in prezdentkxheiw (npm)

Details

The package contains only index.html (declared as main) and package.json. The HTML impersonates a Cloudflare 'Just a moment...' challenge and includes an obfuscator.io-style script whose onTurnstileComplete handler reconstructs a target URL from an encoded string array (_0x2885) and calls window.location.replace to redirect the browser. There are no preinstall/install/postinstall/prepare lifecycle hooks, no JavaScript entrypoint, and the declared main is an HTML file that Node cannot execute via require. Installing or requiring this package does not run code on the installer's machine. The artifact is abuse of the npm registry as static hosting for a phishing/redirect landing page aimed at browser visitors (e.g. via a CDN like unpkg), not a supply-chain attack against installers. ## Source: ghsa-malware (a8b5a4cf417116380c0eb9a942f6dc7b39dbec1a19cf1537bd58d377616040ae) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

OSV advisory ADVISORY PACKAGE PACKAGE

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for block

index.html is a fake Cloudflare verification page.
The Turnstile callback contains heavily obfuscated, self-defending JavaScript.
Callback constructs a fixed hidden URL, copies current query parameters, then calls window.location.replace.
The package name is unrelated to the embedded browser payload.

Evidence against

package.json has no lifecycle scripts, bin, or dependencies.
No filesystem, environment, child-process, or npm install-time behavior is present.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 0 file(s), 0 B of source

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

No flagged code excerpts are attached to this scan.

Findings

4 High1 Low

HighAi Review Evidence

LowNo License