registry / slider-script / 1.0.0

slider-script@1.0.0

AI Security Review

scanned 28d ago · by lpm-firewall-ai

Obfuscated browser scripts replace payment-page behavior and redirect a user-submitted deposit flow to an external payment host. The package does not install or import them automatically, but executing any payload in the intended page activates the behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

A host page loads one of the bundled scripts and the user submits the added deposit form.

Impact

A user can be steered to an attacker-controlled payment flow with their account identifier and transaction details.

Mechanism

Obfuscated payment-flow injection that harvests page data and redirects it externally.

Attack narrative

When one of the bundled browser payloads is inserted into its targeted deposit page, it removes existing QR payment options, adds its own deposit option, obtains the page's member username, and builds an encrypted record containing the username, amount, reference, and return URL. Clicking the injected submit button changes the browser location to payment.meta-engine.dev with that encrypted record. The three payloads are branded variants of the same behavior.

AI rationale

This is concrete, obfuscated payment-flow hijacking and external data transfer, even though it is not automatically run by npm installation. The missing declared entrypoint further suggests the package is a carrier for scripts meant to be injected elsewhere.

Evidence

cnn303_v27a93d2f8c1e5b64a9d0f27c4e8b1a6d3f5c9e2a7b4d8f1c6e0a5b3d9f2c7e.jsk333_7a93d22a499f0a5e89d257ea5e68ca7d25e1265f319c1c1a.jsmr3_f5b83a1d9c7e2046a8d3f6c2b1e9a047d5c8f2b6a3e1d9c4.js

Network endpoints1

slider-script@1.0.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code