twcvhjlksdmx
This report shows the evidence for twcvhjlksdmx@1.0.0. 2 of 2 known versions are blocked or flagged. The newest version, 1.0.1, is blocked. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiDirect source inspection contradicts the clean hint: the package ships an obfuscated fake-CAPTCHA redirect page as its main entrypoint. Although it has no install hook, the user-invoked browser payload is concrete malicious behavior.
Static reason
No blocking static signals were detected.
Trigger
A user opens index.html and the Turnstile callback fires.
Impact
Potential phishing or tracking redirect to a concealed remote site.
Mechanism
Obfuscated query-preserving browser redirect behind a fake CAPTCHA.
Attack narrative
The only packaged entrypoint is a fake Cloudflare verification page. On its callback, obfuscated JavaScript builds a concealed URL, copies the current page's query parameters into it, and redirects with window.location.replace. This has no legitimate npm-package function and creates a concrete browser-phishing/redirect surface.
AI rationale
Direct source inspection contradicts the clean hint: the package ships an obfuscated fake-CAPTCHA redirect page as its main entrypoint. Although it has no install hook, the user-invoked browser payload is concrete malicious behavior.
Evidence
package.jsonindex.html
Network endpoints1
challenges.cloudflare.com/turnstile/v0/api.js
Decision evidence
public snapshotAI called this Malicious at 93.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.html is the manifest main entrypoint.
- index.html presents a Cloudflare-style Turnstile challenge.
- Its completion/error callbacks enter heavily obfuscated code.
- The code constructs an obfuscated URL, copies page query parameters, then calls window.location.replace().
Evidence against
- package.json has no lifecycle scripts.
- No Node filesystem, process, or child-process APIs are present.
Behavioral surface
NoLicense
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
4 High1 Low
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
LowNo License
Affected versions and remediation
This report applies to twcvhjlksdmx@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing twcvhjlksdmx@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.