registry / twcvhjlksdmx / 1.0.0

twcvhjlksdmx@1.0.0

AI Security Review

scanned 4d ago · by lpm-firewall-ai

Opening the package entrypoint shows a fake security-verification page and redirects the browser to an obfuscated destination. Query parameters are propagated to that destination.

Static reason

No blocking static signals were detected.

Trigger

A user opens index.html and the Turnstile callback fires.

Impact

Potential phishing or tracking redirect to a concealed remote site.

Mechanism

Obfuscated query-preserving browser redirect behind a fake CAPTCHA.

Attack narrative

The only packaged entrypoint is a fake Cloudflare verification page. On its callback, obfuscated JavaScript builds a concealed URL, copies the current page's query parameters into it, and redirects with window.location.replace. This has no legitimate npm-package function and creates a concrete browser-phishing/redirect surface.

Rationale

Direct source inspection contradicts the clean hint: the package ships an obfuscated fake-CAPTCHA redirect page as its main entrypoint. Although it has no install hook, the user-invoked browser payload is concrete malicious behavior.

Evidence

package.jsonindex.html

Network endpoints1

challenges.cloudflare.com/turnstile/v0/api.js

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13836

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in twcvhjlksdmx (npm)

Details

The tarball contains only package.json and index.html. package.json declares no preinstall/install/postinstall/prepare lifecycle hooks and sets main to index.html, which is not a loadable JavaScript module and will not execute on npm install or on require(). index.html impersonates a Cloudflare 'Just a moment' interstitial and embeds an obfuscator.io-style script (string-array + base64 _0x5844 decoder) that constructs a URL and calls window.location.replace to redirect the browser. The redirect only fires if a user opens the HTML file in a browser; it does not run against a developer or build system that installs or requires this package. ## Source: ghsa-malware (9b23aefc385a2c9eb5243177ecee09d4e2490a26764cf686946d343cbab9fe53) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

OSV advisory ADVISORY PACKAGE PACKAGE

Decision evidence

public snapshot

AI called this Malicious at 93.0% confidence as Malware with low false-positive risk.

Evidence for block

index.html is the manifest main entrypoint.
index.html presents a Cloudflare-style Turnstile challenge.
Its completion/error callbacks enter heavily obfuscated code.
The code constructs an obfuscated URL, copies page query parameters, then calls window.location.replace().

Evidence against

package.json has no lifecycle scripts.
No Node filesystem, process, or child-process APIs are present.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 0 file(s), 0 B of source

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

No flagged code excerpts are attached to this scan.

Findings

4 High1 Low

HighAi Review Evidence

LowNo License