registry / skxcmwuncbg2 / 1.0.1

skxcmwuncbg2@1.0.1

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Opening the entry page and completing or failing its verification callback activates an opaque redirect chain. It can disclose the page's query parameters to a remotely supplied destination.

Static reason

One or more suspicious static signals were detected.

Trigger

A browser opens index.html and the Turnstile callback runs.

Impact

URL parameters may be sent to an attacker-controlled destination, enabling phishing or data disclosure.

Mechanism

Obfuscated remote fetch, decryption, query forwarding, and browser redirect.

Attack narrative

The page presents a verification screen, then its callback uses obfuscated code to fetch a remote value, decrypt a destination URL, append the current page's query parameters, and replace the browser location. The destination is hidden from source review, so the package can route visitors and their URL-carried data to an operator-selected site.

Rationale

This is a concealed, remotely controlled redirect and query-forwarding mechanism, not a legitimate npm package function. It has no install hook, but its runtime behavior is concrete malicious data-routing behavior.

Evidence

index.htmlpackage.json

Network endpoints1

challenges.cloudflare.com/turnstile/v0/api.js

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for block

The HTML callback contains heavily obfuscated code that fetches a remote response.
The response is decoded and decrypted to obtain a destination.
The code copies current URL parameters to that destination and replaces the browser location.
The manifest exposes this HTML file as the package entry point.

Evidence against

No npm lifecycle scripts are declared.
No local file writes or shell execution are present.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Manifest

NoLicense

scanned 1 file(s), 25.1 KB of source

Source & flagged code

7 flagged

index.htmlView file

Lines 206-231html

206 Performance and Security by

207 <a rel="noopener noreferrer" href="https://www.cloudflare.com/?utm_source=challenge&utm_campaign=m" target="_blank">Cloudflare</a>

208 </span>

209 <span class="footer-divider"></span>

210 <a id="privacy-link" target="_blank" rel="noopener noreferrer" href="https://www.cloudflare.com/privacypolicy/" class="footer-text">Privacy</a>

211 </div>

212 </div>

213 </div>

214</div>

215<script>

216 (function () {

217 function generateRayId() {

218 const chars = '0123456789abcdef';

219 let result = '';

220 for (let i = 0; i < 16; i++) result += chars[Math.floor(Math.random() * 16)];

221 return result;

222 }

223 document.getElementById('dynamic-ray-id').textContent = generateRayId();

224 })();

225

226 function onTurnstileComplete(token) {

High

Ai Review Evidence

The HTML callback contains heavily obfuscated code that fetches a remote response.

index.htmlView on unpkg · L226

227 function _0x3a8ec6(_0x15bf85,_0x238669,_0x560b05,_0x49a429){const _0x3efc9f={_0x1fa456:0xd2};return _0x4c49(_0x49a429-_0x3efc9f._0x1fa456,_0x560b05);}(function(_0x13db49,_0x470044){const _0x4e348f={_0x12649a:0x2aa,_0x1ec61e:0x2a9,_0x207090:0x2d2,_0x42a24a:0x196,_0x31adaa:0x180,_0x1b30b1:0x176,_0x29fbd7:0x157,_0x1113c2:0x168,_0x431058:0x13b,_0x4d5f3e:0x16a,_0x39e79d:0x184,_0x2346a2:0x127,_0x52805e:0x14d,_0x237240:0x13f,_0x3587bb:0x11a,_0x278dc3:0x309,_0xb1b415:0x2ef,_0x55d3c1:0x2fb,_0x597036:0x19b,_0x34c6fb:0x14e,_0x39b0e4:0x178,_0x1d46fc:0x19c,_0x2d0735:0x2a0,_0x20b54f:0x2c8,_0x5e5f31: ...

High

Ai Review Evidence

The HTML callback contains heavily obfuscated code that fetches a remote response.

index.htmlView on unpkg · L227

High

Ai Review Evidence

The response is decoded and decrypted to obtain a destination.

index.htmlView on unpkg · L227

High

Ai Review Evidence

The code copies current URL parameters to that destination and replaces the browser location.

index.htmlView on unpkg · L227

228 }

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L226

229</script>

230</body>

231</html>

Long lines were clipped for display.

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

package.jsonView file

Lines 1-9json

2 "name": "skxcmwuncbg2",

3 "version": "1.0.1",

4 "main": "index.html",

5 "files": [

6 "index.html"

Source & flagged code

7 flagged · loading source

index.htmlView file

226function onTurnstileComplete(token) { L227: function _0x3a8ec6(_0x15bf85,_0x238669,_0x560b05,_0x49a429){const _0x3efc9f={_0x1fa456:0xd2};return _0x4c49(_0x49a429-_0x3efc9f._0x1fa456,_0x560b05);}(function(_0x13db49,_0x470044)... L228: }

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L226

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

226function onTurnstileComplete(token) {

High

Ai Review Evidence

The HTML callback contains heavily obfuscated code that fetches a remote response.

index.htmlView on unpkg · L226

227const _0x28d7b8=await _0x37814a['vnzwr'](fetch,

Findings

7 High1 Medium2 Low

HighObfuscated Payload Loaderindex.html

HighSemantic Analysis Limitedindex.html

HighAi Review Evidenceindex.html

HighAi Review Evidencepackage.json

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowNo License