registry / Credential exfiltration / slider-script
slider-script
This report shows the evidence for slider-script@1.0.0, the only known version.
AI Security Review
scanned 1mo ago · by lpm-firewall-aiThis is concrete, obfuscated payment-flow hijacking and external data transfer, even though it is not automatically run by npm installation. The missing declared entrypoint further suggests the package is a carrier for scripts meant to be injected elsewhere.
Static reason
One or more suspicious static signals were detected.
Trigger
A host page loads one of the bundled scripts and the user submits the added deposit form.
Impact
A user can be steered to an attacker-controlled payment flow with their account identifier and transaction details.
Mechanism
Obfuscated payment-flow injection that harvests page data and redirects it externally.
Attack narrative
When one of the bundled browser payloads is inserted into its targeted deposit page, it removes existing QR payment options, adds its own deposit option, obtains the page's member username, and builds an encrypted record containing the username, amount, reference, and return URL. Clicking the injected submit button changes the browser location to payment.meta-engine.dev with that encrypted record. The three payloads are branded variants of the same behavior.
AI rationale
This is concrete, obfuscated payment-flow hijacking and external data transfer, even though it is not automatically run by npm installation. The missing declared entrypoint further suggests the package is a carrier for scripts meant to be injected elsewhere.
Evidence
cnn303_v27a93d2f8c1e5b64a9d0f27c4e8b1a6d3f5c9e2a7b4d8f1c6e0a5b3d9f2c7e.jsk333_7a93d22a499f0a5e89d257ea5e68ca7d25e1265f319c1c1a.jsmr3_f5b83a1d9c7e2046a8d3f6c2b1e9a047d5c8f2b6a3e1d9c4.js
Network endpoints1
payment.meta-engine.dev/sdk/client.html?d=
Decision evidence
public snapshotAI called this Malicious at 97.0% confidence as Malware with low false-positive risk.
Evidence for block
- All three bundled scripts are deliberately obfuscated browser payloads.
- The payloads alter deposit-page controls and collect the displayed member username, entered amount, and current return URL.
- On a user deposit action, they encrypt those values and redirect the browser to payment.meta-engine.dev.
- The manifest points to a missing index.js, leaving the harmful scripts unreferenced by normal package loading.
- This script embeds the payment.meta-engine.dev client endpoint.
- This script embeds the payment.meta-engine.dev client endpoint.
- This script embeds the payment.meta-engine.dev client endpoint.
Evidence against
- There are no npm lifecycle hooks.
- No Node child-process, filesystem, or environment access was found.
- The browser redirect requires the script to be loaded and a user to submit a deposit.
Behavioral surface
HighEntropyStringsMinifiedObfuscatedTrivial
Source & flagged code
4 flagged · loading sourcemr3_f5b83a1d9c7e2046a8d3f6c2b1e9a047d5c8f2b6a3e1d9c4.jsView file
1window.__METAPAY_SCRIPT_ENABLED__=true;const _0x7ef6e8=_0x276e;(function(_0x109fe5,_0x3cddc7){const _0x2e95a2=_0x276e,_0x5010ca=_0x109fe5();while(!![]){try{const _0xcb6e21=parseInt...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
mr3_f5b83a1d9c7e2046a8d3f6c2b1e9a047d5c8f2b6a3e1d9c4.jsView on unpkg · L11'getElementById','text/html','classList','https://payment.meta-engine.dev/sdk/client.html?d=','getRandomValues'
High
Ai Review Evidence
This script embeds the payment.meta-engine.dev client endpoint.
mr3_f5b83a1d9c7e2046a8d3f6c2b1e9a047d5c8f2b6a3e1d9c4.jsView on unpkg · L1cnn303_v27a93d2f8c1e5b64a9d0f27c4e8b1a6d3f5c9e2a7b4d8f1c6e0a5b3d9f2c7e.jsView file
Findings
5 High1 Medium3 Low
HighObfuscated Payload Loadermr3_f5b83a1d9c7e2046a8d3f6c2b1e9a047d5c8f2b6a3e1d9c4.js
HighObfuscated
HighAi Review Evidencecnn303_v27a93d2f8c1e5b64a9d0f27c4e8b1a6d3f5c9e2a7b4d8f1c6e0a5b3d9f2c7e.js
HighAi Review Evidencek333_7a93d22a499f0a5e89d257ea5e68ca7d25e1265f319c1c1a.js
HighAi Review Evidencemr3_f5b83a1d9c7e2046a8d3f6c2b1e9a047d5c8f2b6a3e1d9c4.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to slider-script@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing slider-script@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.