registry / tib2jcvowuyma / 1.0.0

tib2jcvowuyma@1.0.0

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Opening the HTML entry and completing or failing the displayed verification invokes hidden browser code. It obtains an encrypted redirect target and forwards the current page query parameters to it.

Static reason

One or more suspicious static signals were detected.

Trigger

A user opens index.html and the Turnstile callback runs.

Impact

Users can be redirected to an attacker-selected destination, with URL query data carried to that destination.

Mechanism

Obfuscated remote redirect with encrypted configuration.

Attack narrative

The package consists of a fake Cloudflare verification page. Its callback runs densely obfuscated code that posts an identifier to a concealed endpoint, decrypts a returned URL, copies the current query parameters into that URL, and replaces the browser location. This is a staged phishing or redirection mechanism whose final destination is intentionally hidden from source review.

Rationale

The encrypted remote redirect and query-parameter forwarding are concrete deceptive browser attack behavior. Although npm installation has no lifecycle execution, publishing this package exposes users who open its declared entrypoint to an attacker-controlled redirect.

Evidence

index.html

Network endpoints3

challenges.cloudflare.com/turnstile/v0/api.jswww.cloudflare.com/?utm_source=challenge&utm_campaign=mwww.cloudflare.com/privacypolicy/

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for block

The browser entry disguises itself as a Cloudflare verification page.
The verification callback contains heavily obfuscated code that fetches encrypted data, decrypts it, and redirects the browser while preserving query parameters.
The package has no stated functionality beyond the deceptive HTML payload.

Evidence against

package.json has no lifecycle scripts or dependencies, so npm installation alone does not run the payload.

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Manifest

NoLicense

scanned 1 file(s), 29.1 KB of source

Source & flagged code

6 flagged

index.htmlView file

Lines 1-30text

1<!DOCTYPE html>

2<html lang="en-US" dir="ltr">

3<head>

4 <meta charset="UTF-8">

5 <meta name="robots" content="noindex,nofollow">

6 <meta name="viewport" content="width=device-width, initial-scale=1">

7 <title>Just a moment...</title>

High

Ai Review Evidence

The browser entry disguises itself as a Cloudflare verification page.

index.htmlView on unpkg · L7

9 <link rel="preconnect" href="https://challenges.cloudflare.com" />

10 <script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

High

Ai Review Evidence

The browser entry disguises itself as a Cloudflare verification page.

index.htmlView on unpkg · L10

11 <style>

12 * { box-sizing: border-box; margin: 0; padding: 0; }

13 html {

14 line-height: 1.15;

15 text-size-adjust: 100%;

16 font-family: system-ui, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Arial, sans-serif;

17 background-color: #ffffff;

18 color: #313131;

19 }

20 body {

21 display: flex;

22 flex-direction: column;

23 min-height: 100vh;

24 justify-content: space-between;

25 }

26 @media (prefers-color-scheme: dark) {

27 html { background-color: #313131; color: #f2f2f2; }

28 .main-content h1, .main-content p, .footer-text, .footer-text a { color: #f2f2f2 !important; }

29 .challenge-box { border-color: #e7e7e7 !important; }

30 .status-text, .cloudflare-mark, .cloud-links a { color: #f2f2f2 !important; }

Lines 206-231html

206 Performance and Security by

207 <a rel="noopener noreferrer" href="https://www.cloudflare.com/?utm_source=challenge&utm_campaign=m" target="_blank">Cloudflare</a>

208 </span>

209 <span class="footer-divider"></span>

210 <a id="privacy-link" target="_blank" rel="noopener noreferrer" href="https://www.cloudflare.com/privacypolicy/" class="footer-text">Privacy</a>

211 </div>

212 </div>

213 </div>

214</div>

215<script>

216 (function () {

217 function generateRayId() {

218 const chars = '0123456789abcdef';

219

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

package.jsonView file

Lines 1-9json

2 "name": "tib2jcvowuyma",

3 "version": "1.0.0",

4 "main": "index.html",

5 "files": [

6 "index.html"

Source & flagged code

6 flagged · loading source

index.htmlView file

226function onTurnstileComplete(token) { L227: function _0x214f(_0x3b315a,_0x2d529e){_0x3b315a=_0x3b315a-(0x8b*-0x34+0xd0d+0x1080);const _0x588b95=_0x2da7();let _0x2a284c=_0x588b95[_0x3b315a];if(_0x214f['keRgEE']===undefined){v... L228: }

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L226

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

7<title>Just a moment...</title>

High

Ai Review Evidence

The browser entry disguises itself as a Cloudflare verification page.

index.htmlView on unpkg · L7

10<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>

Findings

6 High2 Medium2 Low

HighObfuscated Payload Loaderindex.html

HighSemantic Analysis Limitedindex.html

HighAi Review Evidenceindex.html

HighAi Review Evidencepackage.json

MediumNetwork

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowNo License