ticketcathayoct12@1.0.0
AI Security Review
scanned 10d ago · by lpm-firewall-aiThe obfuscated, remotely configured browser redirect flow is concrete deceptive behavior in the package entry page. This supports blocking the package as malware.
Static reason
One or more suspicious static signals were detected.
Trigger
Loading index.html starts the script; a timer invokes the redirect flow, and the page also exposes a challenge completion callback.
Impact
Visitors can be silently routed to a destination controlled by remote routing data.
Mechanism
The script submits a host key to an obscured endpoint, reads a cid value from the page URL, requests policy data, and replaces the browser location with a resolved URL.
Attack narrative
The entry page resembles a Cloudflare challenge but contains heavily obfuscated code that retrieves encrypted routing data, makes a request using a URL-supplied identifier, and redirects the browser to a resolved destination. The automatic redirect flow is active on page load. The remote destination is not visible as a literal URL in the inspected source.
AI rationale
The obfuscated, remotely configured browser redirect flow is concrete deceptive behavior in the package entry page. This supports blocking the package as malware.
Evidence
index.htmlpackage.json
Network endpoints1
challenges.cloudflare.com/turnstile/v0/api.js
Decision evidence
public snapshotAI called this Malicious at 88.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json identifies index.html as the package entry point.
- index.html loads Cloudflare Turnstile and contains a heavily obfuscated browser script.
- The script sends a host key to an obscured endpoint and decrypts the response into a URL.
- The script reads a cid value from the page URL and uses it in a request to a policy endpoint.
- After a timer, the script resolves a remote host and replaces the browser location with a returned URL.
Evidence against
Behavioral surface
HighEntropyStringsMinifiedPossibleObfuscation
NoLicense
Source & flagged code
9 flagged · loading sourceindex.htmlView file
182}
L183: (function(_0xe75a3e,_0x4891a0){const _0x1a9338={_0x41948b:0x128,_0x16cff8:0x1a5,_0x265fc5:0x190,_0x4d8482:0x35d,_0x3ad46f:0x31b,_0x11162f:0x34f,_0x22d175:0x10c,_0x5c9743:0x7f,_0x33...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
index.htmlView on unpkg · L182•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
index.htmlView on unpkg10https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>
<style>
* { box-sizing: border-
High
Ai Review Evidence
index.html loads Cloudflare Turnstile and contains a heavily obfuscated browser script.
index.htmlView on unpkg · L10183
Findings
9 High1 Medium2 Low
HighObfuscated Payload Loaderindex.html
HighSemantic Analysis Limitedindex.html
HighAi Review Evidencepackage.json
HighAi Review Evidenceindex.html
HighAi Review Evidenceindex.html
HighAi Review Evidenceindex.html
HighAi Review Evidenceindex.html
HighAi Review Evidenceindex.html
HighAi Review Evidenceindex.html
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowNo License
Affected versions and remediation
This report applies to ticketcathayoct12@1.0.0.
See all versions of ticketcathayoct12 for other recorded verdicts.
- Avoid installing ticketcathayoct12@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.