指纹脚本含反LLM混淆与Node触发代码
veritas的逆向分析报告称，servicepipe.tech提供的一段指纹脚本包含经过混淆的提示词，内容涉及触发AI安全护栏、生物武器及其他有害指令。除这些异常字符串外，脚本还会收集常规浏览器和WebGL信号，并包含在Node.js环境下由环境变量控制的代码，可读取本地配置文件并尝试下载可执行文件。报告没有证明该提示词能够制造生物武器，也没有证明Node.js分支已在生产环境中执行。
这一案例显示，已部署的指纹脚本可能把常规浏览器画像、反LLM混淆和受环境控制的命令结合起来，同时报告中的生物武器说法并不能证明相关系统具备实际的生物能力。
Why Is This Fingerprinting Script Creating Bioweapons?
Wed Oct 28 2026 authored byveritas
Preamble
I've always had a fascination with reverse-engineering browser fingerprinting scripts. Most of my time has been spent looking at the usual suspects (popular fingerprinting libraries like FingerprintJS and more sophisticated scripts used by anti-bots like Cloudflare Turnstile, Akamai, and others).
At some point, I wanted to know what else was out there. I had an idea: What if I crawled the web and intercepted fingerprinting-related browser API calls and mapped it all?
To do this, I used the Tranco Top Sites list and began crawling using Playwright. I would hook canvas toDataURL calls and common fingerprinting/anti-bot properties like navigator.webdriver to filter out benign canvases.
#servicepipe.tech#servicepipe.ru#FingerprintJS#Castle#Playwright#Tranco#fingerprint.garden#Cloudflare Turnstile#Akamai#Node.js