registry / Data exfiltration / tib2jcvowuyma

tib2jcvowuyma

This report shows the evidence for tib2jcvowuyma@1.0.0. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

The encrypted remote redirect and query-parameter forwarding are concrete deceptive browser attack behavior. Although npm installation has no lifecycle execution, publishing this package exposes users who open its declared entrypoint to an attacker-controlled redirect.

Static reason

One or more suspicious static signals were detected.

Trigger

A user opens index.html and the Turnstile callback runs.

Impact

Users can be redirected to an attacker-selected destination, with URL query data carried to that destination.

Mechanism

Obfuscated remote redirect with encrypted configuration.

Attack narrative

The package consists of a fake Cloudflare verification page. Its callback runs densely obfuscated code that posts an identifier to a concealed endpoint, decrypts a returned URL, copies the current query parameters into that URL, and replaces the browser location. This is a staged phishing or redirection mechanism whose final destination is intentionally hidden from source review.

AI rationale

Evidence

index.html

Network endpoints3

challenges.cloudflare.com/turnstile/v0/api.jswww.cloudflare.com/?utm_source=challenge&utm_campaign=mwww.cloudflare.com/privacypolicy/

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for block

The browser entry disguises itself as a Cloudflare verification page.
The verification callback contains heavily obfuscated code that fetches encrypted data, decrypts it, and redirects the browser while preserving query parameters.
The package has no stated functionality beyond the deceptive HTML payload.

Evidence against

package.json has no lifecycle scripts or dependencies, so npm installation alone does not run the payload.

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Manifest

NoLicense

scanned 1 file(s), 29.1 KB of source

Source & flagged code

6 flagged

index.htmlView file

226function onTurnstileComplete(token) { L227: function _0x214f(_0x3b315a,_0x2d529e){_0x3b315a=_0x3b315a-(0x8b*-0x34+0xd0d+0x1080);const _0x588b95=_0x2da7();let _0x2a284c=_0x588b95[_0x3b315a];if(_0x214f['keRgEE']===undefined){v... L228: }

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L226

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

7<title>Just a moment...</title>

High

Ai Review Evidence

The browser entry disguises itself as a Cloudflare verification page.

index.htmlView on unpkg · L7

10<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

High

Ai Review Evidence

The browser entry disguises itself as a Cloudflare verification page.

index.htmlView on unpkg · L10

226function onTurnstileComplete(token) {

High

Ai Review Evidence

The verification callback contains heavily obfuscated code that fetches encrypted data, decrypts it, and redirects the browser while preserving query parameters.

index.htmlView on unpkg · L226

package.jsonView file

1{ "name": "tib2jcvowuyma", "version": "1.0.0", "main": "index.html", "files": [ "index.html" ] }

High

Ai Review Evidence

The package has no stated functionality beyond the deceptive HTML payload.

package.jsonView on unpkg · L1

Source & flagged code

6 flagged · loading source

index.htmlView file

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L226

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

7<title>Just a moment...</title>

High

Ai Review Evidence

The browser entry disguises itself as a Cloudflare verification page.

index.htmlView on unpkg · L7

10<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

Findings

6 High2 Medium2 Low

HighObfuscated Payload Loaderindex.html

HighSemantic Analysis Limitedindex.html

HighAi Review Evidenceindex.html

HighAi Review Evidencepackage.json

MediumNetwork

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowNo License

Affected versions and remediation

This report applies to tib2jcvowuyma@1.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing tib2jcvowuyma@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-23 05:30:06.429Z (UTC).

Source advisory published: 2026-09-23 02:44:19.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

0.0.1-securitylatestClean—AllowPublishedSep 23, 2026, 2:43 AM 1.0.0shownMaliciousData ExfiltrationBlockPublishedSep 3, 2026, 2:49 AM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other data exfiltration packages

Source & flagged code

Related packages

Other data exfiltration packages