registry / xsjukcnv8low26 / 1.0.1

xsjukcnv8low26@1.0.1

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Opening the package's HTML activates a deceptive verification flow. Completion or failure of the challenge triggers opaque network-driven redirection that forwards URL query parameters.

Static reason

One or more suspicious static signals were detected.

Trigger

A user opens index.html and a Turnstile callback fires.

Impact

The operator can send victims to an undisclosed destination and receive query parameters supplied in the original URL.

Mechanism

Obfuscated remote destination decryption and browser redirect.

Attack narrative

The package ships only a Cloudflare-lookalike HTML page. Its verification callbacks invoke hidden code that fetches a response from an obscured endpoint, decrypts a destination URL, adds the current page's query parameters, and redirects the browser. This conceals the actual destination from users and reviewers and can support phishing or tracking.

Rationale

This is a deceptive, obfuscated browser redirector rather than a legitimate npm library. It has no install hook, but the delivered runtime behavior is concrete malicious traffic routing.

Evidence

index.html

Network endpoints1

challenges.cloudflare.com

Decision evidence

public snapshot

AI called this Malicious at 97.0% confidence as Malware with low false-positive risk.

Evidence for block

The sole shipped HTML is a fake Cloudflare-style verification page.
Every Turnstile callback invokes a heavily obfuscated routine.
That routine contacts a concealed endpoint, decrypts a server-supplied destination, copies the current query parameters, and redirects the browser.

Evidence against

package.json contains no lifecycle scripts or dependencies.
No local file, environment, or child-process access was found.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsMinifiedPossibleObfuscation

Manifest

NoLicense

scanned 1 file(s), 36.9 KB of source

Source & flagged code

5 flagged

index.htmlView file

Lines 158-231text

158 flex-direction: column;

159 gap: 12px;

160 }

161 .footer-wrapper { display: flex; justify-content: space-between; align-items: center; flex-wrap: wrap; gap: 10px; }

162 .ray-id { font-family: monospace; font-size: 13px; color: #8c8c8c; }

163 .ray-id code { font-family: monospace; font-weight: bold; }

164 .footer-link-wrapper { font-size: 13px; color: #8c8c8c; display: flex; align-items: center; }

165 .footer-text a { color: #0051c3; text-decoration: none; }

166 .footer-text a:hover { text-decoration: underline; }

167 .footer-divider { display: inline-block; width: 1px; height: 12px; background-color: #8c8c8c; margin: 0 10px; }

168 @media (max-width: 600px) {

169 .footer-wrapper { flex-direction: column; align-items: flex-start; }

170 .footer-divider { display: none; }

171 .footer-link-wrapper { flex-direction: column; align-items: flex-start; gap: 4px; }

172 }

173 </style>

174</head>

175<body>

176<div class="main-wrapper" role="main">

177 <div class="main-content">

178 <div class="ch-title-zone"><h1>Performing security verification</h1></div>

179 <p class="ch-description">

180 This website uses a security service to protect against malicious bots. This page is displayed while the website verifies you are not a bot.

181 </p>

High

Ai Review Evidence

The sole shipped HTML is a fake Cloudflare-style verification page.

index.htmlView on unpkg · L178

182

183 <div class="cf-turnstile-container">

184 <div class="cf-turnstile"

185 data-appearance="always"

186 data-sitekey="0x4AAAAAADrvn4rDM7WVvgPh"

187 data-theme="auto"

188 data-language="en-US"

189 data-callback="onTurnstileComplete"

190 data-error-callback="onTurnstileComplete"

191 data-expired-callback="onTurnstileComplete"

192 data-timeout-callback="onTurnstileComplete"

193 data-unsupported-callback="onTurnstileComplete">

High

Ai Review Evidence

Every Turnstile callback invokes a heavily obfuscated routine.

index.htmlView on unpkg · L188

194 </div>

195 </div>

196 </div>

197</div>

198<div class="footer" role="contentinfo">

199 <div class="footer-inner">

200 <div class="footer-wrapper">

201 <div class="clearfix diagnostic-wrapper">

202 <div class="ray-id">Ray ID: <code id="dynamic-ray-id">---------</code></div>

203 </div>

204 <div class="footer-link-wrapper">

205 <span class="footer-text">

206 Performance and Security by

207 <a rel="noopener noreferrer" href="https://www.cloudflare.com/?utm_source=challenge&utm_campaign=m" target="_blank">Cloudflare</a>

208 </span>

209 <span class="footer-divider"></span>

210 <a id="privacy-link" target="_blank" rel="noopener noreferrer" href="https://www.cloudflare.com/privacypolicy/" class="footer-text">Privacy</a>

211 </div>

212 </div>

213 </div>

214</div>

215<script>

216 (function () {

217 function generateRayId() {

218 const chars = '0123456789abcdef';

219 let result = '';

220 for (let i = 0; i < 16; i++) result += chars[Math.floor(Math.random() * 16)];

221 return result;

222 }

223 document.getElementById('dynamic-ray-id').textContent = generateRayId();

224 })();

225

226 function onTurnstileComplete(token) {

High

Ai Review Evidence

That routine contacts a concealed endpoint, decrypts a server-supplied destination, copies the current query parameters, and redirects the browser.

index.htmlView on unpkg · L226

227 function _0x4d2b(_0x403e0a,_0x28b0ab){_0x403e0a=_0x403e0a-(0x110c+-0x2584+0x15e1);const _0x2aa8dc=_0x5788();let _0x46939d=_0x2aa8dc[_0x403e0a];if(_0x4d2b['hNNmcj']===undefined){var _0xd0ff89=function(_0x12ba27){const _0x40917c='abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789+/=';let _0x407318='',_0x5a87a5='',_0x393899=_0x407318+_0xd0ff89,_0xcb7e7c=(''+function(){return 0x15*-0x8+-0x862+-0x90a*-0x1;})['indexOf']('\x0a')!==-(-0x290+-0x12e5+0x1576);for(let _0x5ac179=0x15*0xba+-0xe83+-0xbf*0x1,_0x37e8e8,_0x4dc301,_0x22e264=0x1aa+0x7*0x35a+-0x192*0x10;_0x4dc301=_0x12ba27['cha ...

228 }

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L226

229</script>

230</body>

231</html>

Long lines were clipped for display.

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

Source & flagged code

5 flagged · loading source

index.htmlView file

226function onTurnstileComplete(token) { L227: function _0x4d2b(_0x403e0a,_0x28b0ab){_0x403e0a=_0x403e0a-(0x110c+-0x2584+0x15e1);const _0x2aa8dc=_0x5788();let _0x46939d=_0x2aa8dc[_0x403e0a];if(_0x4d2b['hNNmcj']===undefined){var... L228: }

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L226

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

178<div class="ch-title-zone"><h1>Performing security verification</h1></div> <p class="ch-description"> This website uses a security service to protect against malicious bots. This page is displayed while the website verifies you are not a bot. </p>

High

Ai Review Evidence

The sole shipped HTML is a fake Cloudflare-style verification page.

index.htmlView on unpkg · L178

Findings

5 High1 Medium2 Low

HighObfuscated Payload Loaderindex.html

HighSemantic Analysis Limitedindex.html

HighAi Review Evidenceindex.html

MediumStructural Risk Force Deep Review

LowHigh Entropy Strings

LowNo License