vfgnhlkxchrd
This report shows the evidence for vfgnhlkxchrd@1.0.1. 2 of 2 known versions are blocked or flagged. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiAlthough there is no lifecycle hook, the declared main file contains a deliberately obfuscated fake-verification redirect to a Microsoft-lookalike domain. This is concrete malicious browser behavior.
Static reason
No blocking static signals were detected.
Trigger
User opens index.html and the Turnstile callback fires.
Impact
Enables phishing by forwarding victims and URL parameters to a lookalike domain.
Mechanism
Obfuscated query-forwarding browser redirect
Attack narrative
The sole package payload is an HTML page impersonating a Cloudflare security check. Its obfuscated callback constructs https://config.microsofte.live/, copies the current page query parameters, and replaces the browser location after the challenge callback, creating a concrete phishing-redirection chain.
AI rationale
Although there is no lifecycle hook, the declared main file contains a deliberately obfuscated fake-verification redirect to a Microsoft-lookalike domain. This is concrete malicious browser behavior.
Evidence
package.jsonindex.html
Network endpoints2
challenges.cloudflare.com/turnstile/v0/api.jsconfig.microsofte.live/
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- index.html is an obfuscated browser payload disguised as a Cloudflare verification page.
- After Turnstile completion, it redirects the browser to config.microsofte.live.
- The redirect copies all current URL query parameters to the destination.
Evidence against
- package.json has no lifecycle scripts or dependencies.
- No install-time Node execution is defined.
Behavioral surface
NoLicense
Source & flagged code
0 flagged · loading sourceNo flagged code excerpts are attached to this scan.
Findings
3 High1 Low
HighAi Review Evidence
HighAi Review Evidence
HighAi Review Evidence
LowNo License
Affected versions and remediation
This report applies to vfgnhlkxchrd@1.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing vfgnhlkxchrd@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.