registry / vfgnhlkxchrd / 1.0.1

vfgnhlkxchrd@1.0.1

AI Security Review

scanned 4d ago · by lpm-firewall-ai

Opening the package main HTML presents a fake security-verification page and redirects the browser to an unrelated lookalike domain. No install-time attack surface was found.

Static reason

No blocking static signals were detected.

Trigger

User opens index.html and the Turnstile callback fires.

Impact

Enables phishing by forwarding victims and URL parameters to a lookalike domain.

Mechanism

Obfuscated query-forwarding browser redirect

Attack narrative

The sole package payload is an HTML page impersonating a Cloudflare security check. Its obfuscated callback constructs https://config.microsofte.live/, copies the current page query parameters, and replaces the browser location after the challenge callback, creating a concrete phishing-redirection chain.

Rationale

Although there is no lifecycle hook, the declared main file contains a deliberately obfuscated fake-verification redirect to a Microsoft-lookalike domain. This is concrete malicious browser behavior.

Evidence

package.jsonindex.html

Network endpoints2

challenges.cloudflare.com/turnstile/v0/api.jsconfig.microsofte.live/

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13840

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in vfgnhlkxchrd (npm)

Details

vfgnhlkxchrd@1.0.1 contains a single HTML file (referenced as the package main) that mimics a Cloudflare 'Just a moment...' challenge. Embedded obfuscated JavaScript (hex-prefixed identifiers and a string-array dispatcher) reconstructs the URL https://config.microsofte.live/ from split string fragments and calls window.location.replace(targetUrl) on load. The domain config.microsofte.live is a typosquat of microsoft.live/microsoft.com. There are no lifecycle scripts and the main entry is an HTML file, so `npm install` and `require()` of this package do not execute the redirect against an installer; the payload only fires when the file is loaded in a browser via an npm CDN (unpkg/jsdelivr). The package is being used as free hosting for phishing infrastructure rather than as a Node module. ## Source: ghsa-malware (6eb5c459ae24a6ced08914cb24fb7d00528a335226d4bf14b83e04ac0d83a886) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

OSV advisory ADVISORY PACKAGE PACKAGE

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

index.html is an obfuscated browser payload disguised as a Cloudflare verification page.
After Turnstile completion, it redirects the browser to config.microsofte.live.
The redirect copies all current URL query parameters to the destination.

Evidence against

package.json has no lifecycle scripts or dependencies.
No install-time Node execution is defined.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 0 file(s), 0 B of source

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

No flagged code excerpts are attached to this scan.

Findings

3 High1 Low

HighAi Review Evidence

LowNo License