registry / xsjukcnv8low26 / 1.0.0

xsjukcnv8low26@1.0.0

AI Security Review

scanned 3h ago · by lpm-firewall-ai

Opening the package entry displays a fake security-verification page. Its opaque callback obtains and decrypts a remote redirect target.

Static reason

One or more suspicious static signals were detected.

Trigger

A visitor loads index.html and any Turnstile callback fires.

Impact

It can redirect a visitor to an attacker-selected destination while preserving current URL parameters.

Mechanism

Encrypted remote redirect loader

Attack narrative

The package is a browser page disguised as a Cloudflare verification screen. Completion and failure callbacks enter heavily obfuscated code that posts a hidden identifier, decrypts a server-provided value, appends the current query parameters, and replaces the browser location. This creates a concealed, remotely controlled redirect chain suitable for phishing or traffic delivery.

Rationale

The active, obfuscated remote redirect mechanism has no legitimate package purpose and hides its final destination. The absence of npm lifecycle hooks limits installation impact but does not neutralize the browser-delivered malicious behavior.

Evidence

index.html

Network endpoints1

challenges.cloudflare.com/turnstile/v0/api.js

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Evidence for block

The manifest exposes index.html as the package entry point.
All challenge outcomes invoke the same opaque handler.
That handler fetches encrypted remote data, decrypts a destination, copies URL parameters, and redirects the browser.

Evidence against

There are no npm lifecycle scripts or Node dependencies.
No local file or shell operations are present.

Behavioral surface

Source

Network

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Manifest

NoLicense

scanned 1 file(s), 39.5 KB of source

Source & flagged code

4 flagged

index.htmlView file

Lines 169-231text

169 .footer-wrapper { flex-direction: column; align-items: flex-start; }

170 .footer-divider { display: none; }

171 .footer-link-wrapper { flex-direction: column; align-items: flex-start; gap: 4px; }

172 }

173 </style>

174</head>

175<body>

176<div class="main-wrapper" role="main">

177 <div class="main-content">

178 <div class="ch-title-zone"><h1>Performing security verification</h1></div>

179 <p class="ch-description">

180 This website uses a security service to protect against malicious bots. This page is displayed while the website verifies you are not a bot.

181 </p>

182

183 <div class="cf-turnstile-container">

184 <div class="cf-turnstile"

185 data-appearance="always"

186 data-sitekey="0x4AAAAAADrvn4rDM7WVvgPh"

187 data-theme="auto"

188 data-language="en-US"

189 data-callback="onTurnstileComplete"

190 data-error-callback="onTurnstileComplete"

191 data-expired-callback="onTurnstileComplete"

192 data-timeout-callback="onTurnstileComplete"

193 data-unsupported-callback="onTurnstileComplete">

High

Ai Review Evidence

All challenge outcomes invoke the same opaque handler.

index.htmlView on unpkg · L189

194 </div>

195 </div>

196 </div>

197</div>

198<div class="footer" role="contentinfo">

199 <div class="footer-inner">

200 <div class="footer-wrapper">

201 <div class="clearfix diagnostic-wrapper">

202 <div class="ray-id">Ray ID: <code id="dynamic-ray-id">---------</code></div>

203 </div>

204 <div class="footer-link-wrapper">

205 <span class="footer-text">

206 Performance and Security by

207 <a rel="noopener noreferrer" href="https://www.cloudflare.com/?utm_source=challenge&utm_campaign=m" target="_blank">Cloudflare</a>

208 </span>

209 <span class="footer-divider"></span>

210 <a id="privacy-link" target="_blank" rel="noopener noreferrer" href="https://www.cloudflare.com/privacypolicy/" class="footer-text">Privacy</a>

211 </div>

212 </div>

213 </div>

214</div>

215<script>

216 (function () {

217 function generateRayId() {

218 const chars = '0123456789abcdef';

219 let result = '';

220 for (let i = 0; i < 16; i++) result += chars[Math.floor(Math.random() * 16)];

221 return result;

222 }

223 document.getElementById('dynamic-ray-id').textContent = generateRayId();

224 })();

225

226 function onTurnstileComplete(token) {

227 function _0x1359b2(_0x473a9b,_0x58b77b,_0x1e8010,_0x462036){return _0x5a44(_0x462036- -0x104,_0x473a9b);}(function(_0x50b1a3,_0x5901dc){const _0x139539={_0x41a33c:0x398,_0x38beae:0x373,_0x4d6cc0:0x368,_0x146ebf:0x363,_0x40d6b6:0x38e,_0x50f8fb:0x385,_0x173052:0x392,_0x284ebc:0x308,_0x5c13c3:0x30e,_0x386911:0x33e,_0x2acd61:0x334,_0xe3830f:0x336,_0x5f27c6:0x354,_0x4021dd:0x33f,_0xab1193:0x201,_0x3d4c02:0x238,_0x5da059:0x1f1,_0x2de494:0x213,_0x540dae:0x221,_0x306b6b:0x223,_0x32f037:0x204,_0x4ba47b:0x2f8,_0x183a64:0x32f,_0x531b4c:0x351,_0x39a235:0x368,_0x459cb1:0x340,_0x38b745:0x2f0,_0x1ee1 ...

228 }

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L226

229</script>

230</body>

231</html>

Long lines were clipped for display.

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

package.jsonView file

Lines 1-9json

2 "name": "xsjukcnv8low26",

3 "version": "1.0.0",

4 "main": "index.html",

5 "files": [

6 "index.html"

Source & flagged code

4 flagged · loading source

index.htmlView file

226function onTurnstileComplete(token) { L227: function _0x1359b2(_0x473a9b,_0x58b77b,_0x1e8010,_0x462036){return _0x5a44(_0x462036- -0x104,_0x473a9b);}(function(_0x50b1a3,_0x5901dc){const _0x139539={_0x41a33c:0x398,_0x38beae:0... L228: }

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L226

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

189data-callback="onTurnstileComplete" data-error-callback="onTurnstileComplete" data-expired-callback="onTurnstileComplete" data-timeout-callback="onTurnstileComplete" data-unsupported-callback="onTurnstileComplete">

High

Ai Review Evidence

All challenge outcomes invoke the same opaque handler.

index.htmlView on unpkg · L189

Findings

4 High2 Medium2 Low

HighObfuscated Payload Loaderindex.html

HighSemantic Analysis Limitedindex.html

HighAi Review Evidencepackage.json

HighAi Review Evidenceindex.html

MediumNetwork

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowNo License