classroomhomework @1.0.0

Summary

The package's index.html impersonates Google Classroom (title, gstatic favicon, hardcoded student email student111@risd.edu, decoy schedule/gradebook code explicitly commented // --- decoy classroom functionality below --- ) as a cover for a remote-fetch-and-execute primitive. Embedded JavaScript reconstructs a fragmented path from a _paths array ( ["/gh/", "s0n-1m-", "cr1n3/", "sc13nc3/", "assets/", "index.html"] ) joined at runtime to form /gh/s0n-1m-cr1n3/sc13nc3/assets/index.html , prefixes a jsDelivr mirror host, fetches the URL, and writes the response body into a new browser tab via document.write , which parses and executes it as HTML/JS. A setTimeout fires the fetch automatically 500 ms after page load, and a hidden class code modal (m1..m5) triggers the same fetch on demand. Because the jsDelivr path targets a personal GitHub repository ( s0n-1m-cr1n3/sc13nc3 ) pinned to no commit, the operator can swap the delivered payload at any time. The split-string obfuscation of the destination and the author-labeled decoy UI show intent to conceal the delivery channel behind a Google Classroom facade.

Source: amazon-inspector (b64edbbd8d1e23d937c4697de257a67981be2ebb2934a4280424a86f4af7028f)