registry / Staged payload carrier / px8my
px8my
This report shows the evidence for px8my@1.0.54. 34 of 35 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 3mo ago · by lpm-firewall-aiThis is concrete browser page hijacking and remote payload delivery, not an inert helper or benign dependency behavior.
Static reason
No blocking static signals were detected.
Trigger
Importing or including `px.js` in a browser page.
Impact
Hijacks the host page and exposes users to remotely controlled content.
Mechanism
Fullscreen page takeover via remote iframe injection.
Attack narrative
The package's main file executes on load, overlays the entire browser viewport, and embeds content from an external domain. The publisher helper supports rapidly replacing that domain and publishing/cache-purging updates, consistent with maintaining a remotely controlled redirect payload.
AI rationale
This is concrete browser page hijacking and remote payload delivery, not an inert helper or benign dependency behavior.
Evidence
package.jsonpx.jsupdate_px8my.sh
Network endpoints2
mfmz.piolzo.cn/H.html?c=0gjrpurge.jsdelivr.net/npm/px8my/px.js
Decision evidence
public snapshotAI called this Malicious at 98.0% confidence as Malware with low false-positive risk.
Evidence for block
- `px.js` runs immediately in a browser context and replaces the page with a fullscreen iframe.
- `px.js` loads `https://mfmz.piolzo.cn/H.html?c=0gjr`, giving a remote host control of displayed content.
- `px.js` uses a loading mask and highest z-index to conceal the host page.
- `update_px8my.sh` rotates the embedded domain, publishes a new package version, and purges the CDN cache.
Evidence against
- `package.json` has no preinstall, install, or postinstall lifecycle hook.
- No credential harvesting, local file access, or child-process execution appears in the inspected runtime source.
Behavioral surface
HighEntropyStringsMinifiedTrivial
Source & flagged code
1 flagged · loading sourceupdate_px8my.shView file
•path = update_px8my.sh
kind = build_helper
sizeBytes = 1400
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
update_px8my.shView on unpkgFindings
1 Medium2 Low
MediumShips Build Helperupdate_px8my.sh
LowScripts Present
LowHigh Entropy Strings
Affected versions and remediation
This report applies to px8my@1.0.54.
The versions list below shows the verdict for each recorded version.
- Avoid installing px8my@1.0.54. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.