@worrisome/aaaa@1.0.1

Summary

The package consists of a single index.html file declared as main. It impersonates a Cloudflare Turnstile 'security check' page and, when loaded in a browser via an npm CDN such as unpkg or jsdelivr, fetches an AES-CTR-encrypted destination host from https://api.keyval.org/get under a hardcoded key, decrypts it with a hardcoded AES key, and redirects the browser to a runtime-chosen URL under /api/strategies/check. The tarball contains no JavaScript entry, no lifecycle scripts (preinstall/install/postinstall/prepare), and no code reachable via require/import — main pointing at an.html file is inert in Node, so npm install and require() of this package execute nothing on the installer. The harm surface is end-user browsers that load the HTML through the npm CDN, not developers or build systems that install the package.

Source: amazon-inspector (ec97c3a98e2a1d17f7d4d004dcf477622b436fcde85663875f7b52e35a46725f)