Build1 publisher3 min readPublished
A Lnkr payload sat in URLScan for nearly two and a half years marked "No classification"
Cloudflare says its graph model flagged eight malicious scripts running on live storefronts. A retrospective check put seven of the eight outside VirusTotal entirely. URLScan flagged none of the eight as malicious.
The Engineer · Build desk
What happened
- Cloudflare says its Page Shield ML model uncovered four operations spanning eight payloads in the wild, with detection automated and humans verifying each finding only after the system flagged it.
- A later review using security scanning tools found seven of the eight payloads entirely absent from VirusTotal, and URLScan flagged none of the eight as malicious.
- One version of a Lnkr-family payload had been indexed by URLScan for nearly two and a half years with "No classification", including during a direct scan in January 2024.
- The same graph neural network had already caught malicious npm packages and an in-the-wild Magecart payment skimmer, and here it caught all eight payloads in live traffic.
Compiled by The EngineerSomething wrong?How this is made
Why it matters
- constraint Gating on device, country, time, referrer or browser state means a periodic scan can archive a clean copy of a script that still fires for real shoppers.
- decision Teams that use a clean VirusTotal or URLScan result as sign-off for a third-party script are leaning on a check that produced no malicious verdict for eight scripts already running on production storefronts.
- exposure VirusTotal now flags the Lnkr script. The verdict is undated in its public history, so a site relying on hash reputation cannot bound how long it served the payload unlabelled.
- capability Because the model judges a syntax tree, it can catch a renamed or minified variant that has no known URL or byte signature on file.
Malicious JavaScript on a storefront can siphon affiliate revenue, hijack searches and clicks, tamper with analytics, or ask a remote server what to execute next, all while pages load and checkout works [21]. One of the four operations Cloudflare describes stayed dormant unless the device, country, time, referrer or browser state matched what it was waiting for [10]. A single fetch that fails those conditions gets the inert version of the script. Another operation hid a clickless affiliate request inside an invisible iframe, and others intercepted clicks, suppressed monitoring, or conditionally loaded more code from remote servers [11]. Cloudflare's post argues that checking the page once is not enough, because scripts like these are built to stay quiet until the right victim shows up [22].
The Lnkr payload is the one case in the set that VirusTotal had ingested earlier [6]. Exactly one of the eight was in VirusTotal at review [20]. VirusTotal currently flags that script as malicious, and Cloudflare says the public history gives no date for when the verdict was first assigned [6]. Page Shield ML surfaced those exact bytes live on an online retailer's storefront [7]. "If your defense waits for that label, you are already late," Cloudflare wrote [8].
The eight payloads are the ones Cloudflare's own model flagged, and humans reviewed each finding only after the system had flagged it [2]. So the seven-of-eight figure measures how much of this detector's output the scanners already had, not how much of the scanners' output the detector missed. The post leaves that second count out. For the number to mean the same thing on another storefront, that storefront's third-party scripts would have to be gated the same way. Whatever watches them would also have to see real browser sessions.
The detection path has stages. The GNN treats JavaScript as a graph, a syntax tree connecting code symbols that exposes what calls what and what the attacker tried to bury [12]. Scripts it labels malicious are under 0.3% of all analyzed traffic. Those go to a lightweight LLM on Workers AI for a live second opinion, and customers are alerted when the LLM corroborates the GNN [14]. At that rate, fewer than three scripts in every thousand analyzed reach the second stage [15].
For the most intricate scripts, Cloudflare runs a cohort of frontier models drawn from around six families, including open-weight models on Workers AI. Each one is spun up as an agent in its own fresh, independent session and given a restricted JavaScript evaluator to unpack small snippets [16]. Their labels become votes weighted by each model's score in the Artificial Analysis Intelligence Index, producing a probability distribution over benign, payment skimming, other malware and cryptomining [17]. Cloudflare says it will soon extend the workflow with Cloudflare Sandbox for deeper analysis in isolated environments [18].
What to watch
- Whether Cloudflare publishes the reverse count: scripts VirusTotal or URLScan flagged that Page Shield ML did not.
- The Cloudflare Sandbox extension landing, and whether isolated-environment analysis moves the sub-0.3% GNN flag rate.
- Whether vote weights change as models move in the Artificial Analysis Intelligence Index, since that index sets each judge's weight.