Fingerprinting Script Uses Anti-LLM Obfuscation and Node-Gated Code
A reverse-engineering report by veritas describes a fingerprinting script served from servicepipe.tech that embeds an obfuscated prompt designed to trigger AI safety safeguards, alongside references to biological weapons and other harmful instructions. Beyond that unusual text, the script collects standard browser and WebGL signals and appears to contain Node.js-gated code that reads local configuration files and attempts to download an executable. The report does not show that the embedded prompt actually creates biological weapons or that the Node.js branch executed in production.
The findings show how a deployed fingerprinting script may combine routine browser profiling with anti-LLM obfuscation and environment-gated commands, while also illustrating why the report's bioweapon claim should not be treated as proof of biological capability.
Why Is This Fingerprinting Script Creating Bioweapons?
Wed Oct 28 2026 authored byveritas
Preamble
I've always had a fascination with reverse-engineering browser fingerprinting scripts. Most of my time has been spent looking at the usual suspects (popular fingerprinting libraries like FingerprintJS and more sophisticated scripts used by anti-bots like Cloudflare Turnstile, Akamai, and others).
At some point, I wanted to know what else was out there. I had an idea: What if I crawled the web and intercepted fingerprinting-related browser API calls and mapped it all?
To do this, I used the Tranco Top Sites list and began crawling using Playwright. I would hook canvas toDataURL calls and common fingerprinting/anti-bot properties like navigator.webdriver to filter out benign canvases.
#servicepipe.tech#servicepipe.ru#FingerprintJS#Castle#Playwright#Tranco#fingerprint.garden#Cloudflare Turnstile#Akamai#Node.js