vjkpwjxbvndelta@1.0.1
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe obfuscated remote destination lookup, automatic redirect, and visitor-parameter forwarding establish an active traffic-redirection behavior behind a challenge-style page. This is malicious behavior rather than an inert payload carrier.
Static reason
One or more suspicious static signals were detected.
Trigger
Opening index.html in a browser starts the remote lookup and automatic redirect.
Impact
Visitors can be routed to a remotely selected destination without an explicit navigation choice, with their URL parameters included.
Mechanism
The script sends an obfuscated key to a keyval.org endpoint, decrypts the returned destination, copies current URL parameters to it, and navigates the browser there.
Attack narrative
The page imitates a Cloudflare challenge but runs obfuscated code that obtains an encrypted destination from a remote service and redirects the visitor automatically. It also forwards the current page’s URL parameters to that destination. This provides a concealed traffic-routing surface; the actual redirect destination is remotely selected.
AI rationale
The obfuscated remote destination lookup, automatic redirect, and visitor-parameter forwarding establish an active traffic-redirection behavior behind a challenge-style page. This is malicious behavior rather than an inert payload carrier.
Evidence
index.html
Network endpoints2
challenges.cloudflare.com/turnstile/v0/api.jsapi.keyval.org/get
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package declares index.html as its main entry point.
- The page presents a Cloudflare Turnstile challenge while loading Cloudflare’s script.
- Obfuscated code sends a key to a keyval.org endpoint, decrypts the response, and constructs a destination URL.
- The script copies parameters from the current page URL to the destination and navigates the browser there.
- The page calls the redirect automatically after a short delay.
Evidence against
Behavioral surface
HighEntropyStringsMinifiedPossibleObfuscation
NoLicense
Source & flagged code
9 flagged · loading sourceindex.htmlView file
182}
L183: (function(_0x2f826d,_0x1ee9cd){const _0x51da19={_0x1822b8:0x1a3,_0x59d080:0x203,_0x5c8956:0x196,_0x3994af:0x1de,_0x44cfc0:0x1fb,_0x58f4c3:0x1c8,_0x23dba6:0x22a,_0x565225:0x114,_0x4...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
index.htmlView on unpkg · L182•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
index.htmlView on unpkg9ttps://challenges.cloudflare.com" />
<script src="https://challenges.cloudflare.com/turnstile/v0/api.js" async defer></script>
<style>
* { box-sizing: border-box; margin: 0; padding: 0; }
High
Ai Review Evidence
The page presents a Cloudflare Turnstile challenge while loading Cloudflare’s script.
index.htmlView on unpkg · L9Findings
9 High1 Medium2 Low
HighObfuscated Payload Loaderindex.html
HighSemantic Analysis Limitedindex.html
HighAi Review Evidencepackage.json
HighAi Review Evidenceindex.html
HighAi Review Evidenceindex.html
HighAi Review Evidenceindex.html
HighAi Review Evidenceindex.html
HighAi Review Evidenceindex.html
HighAi Review Evidenceindex.html
MediumStructural Risk Force Deep Review
LowHigh Entropy Strings
LowNo License
Affected versions and remediation
This report applies to vjkpwjxbvndelta@1.0.1.
See all versions of vjkpwjxbvndelta for other recorded verdicts.
- Avoid installing vjkpwjxbvndelta@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.