registry / vfgnhlkxchrd / 1.0.0

vfgnhlkxchrd@1.0.0

AI Security Review

scanned 9d ago · by lpm-firewall-ai

Opening the package's main HTML and completing or failing the displayed Turnstile callback redirects the browser to a disguised external login site. All source-page query parameters are forwarded.

Static reason

No blocking static signals were detected.

Trigger

User opens index.html and the Turnstile callback runs.

Impact

Phishing and disclosure of URL-borne tokens or other query data.

Mechanism

Obfuscated query-preserving redirect to a typosquatted login host

Attack narrative

The package presents a Cloudflare-style security-verification screen. Its obfuscated onTurnstileComplete handler builds https://login.microsofte.live/, appends every existing query parameter, then redirects the browser. This enables phishing at a Microsoft-lookalike endpoint and leaks URL query data.

Rationale

The only executable package entrypoint contains a concrete obfuscated redirect to a likely phishing domain, not a legitimate package function. Absence of install hooks does not remove the runtime phishing behavior.

Evidence

package.jsonindex.html

Network endpoints2

challenges.cloudflare.comlogin.microsofte.live/

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13840

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in vfgnhlkxchrd (npm)

Details

vfgnhlkxchrd@1.0.1 contains a single HTML file (referenced as the package main) that mimics a Cloudflare 'Just a moment...' challenge. Embedded obfuscated JavaScript (hex-prefixed identifiers and a string-array dispatcher) reconstructs the URL https://config.microsofte.live/ from split string fragments and calls window.location.replace(targetUrl) on load. The domain config.microsofte.live is a typosquat of microsoft.live/microsoft.com. There are no lifecycle scripts and the main entry is an HTML file, so `npm install` and `require()` of this package do not execute the redirect against an installer; the payload only fires when the file is loaded in a browser via an npm CDN (unpkg/jsdelivr). The package is being used as free hosting for phishing infrastructure rather than as a Node module. ## Source: ghsa-malware (6eb5c459ae24a6ced08914cb24fb7d00528a335226d4bf14b83e04ac0d83a886) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

OSV advisory ADVISORY PACKAGE PACKAGE

Decision evidence

public snapshot

AI called this Malicious at 98.0% confidence as Malware with low false-positive risk.

Evidence for block

index.html is the package main and embeds a fake Cloudflare verification page.
Obfuscated callback constructs https://login.microsofte.live/ and redirects the browser there.
It copies every current-page query parameter into the redirect URL.
The target resembles a Microsoft-login typosquat and the code is deliberately obfuscated.

Evidence against

package.json contains no lifecycle scripts.
No local file, environment, or child-process access is present.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 0 file(s), 0 B of source

Source & flagged code

1 flagged

package.jsonView file

•Published source reference

High

Typosquat Dependency

The target resembles a Microsoft-login typosquat and the code is deliberately obfuscated.

package.jsonView on unpkg

Source & flagged code

1 flagged · loading source

package.jsonView file

•Published source reference

High

Typosquat Dependency

The target resembles a Microsoft-login typosquat and the code is deliberately obfuscated.

package.jsonView on unpkg

Findings

4 High1 Low

HighAi Review Evidence

HighTyposquat Dependencypackage.json

LowNo License