@worrisome/reutil@1.0.5

Summary

The package's only shipped artifact is an index.html file that imitates a Cloudflare 'Just a moment...' challenge. The page fetches an AES-CTR-encrypted destination from https://api.keyval.org/get using a hardcoded key, decrypts it in the browser, and redirects via window.location.replace. There is no JavaScript module entry point, no require-able code, and no preinstall/install/postinstall/prepare lifecycle scripts in package.json. Installing or importing the package in a Node/npm context does not read installer secrets, fetch or execute remote code, or establish any network callback on the installer's machine. The abuse pattern is use of the npm registry as hosting for a browser-facing redirect/phishing landing page, which affects humans who open the HTML in a browser rather than developers who install the package as a dependency.

Source: amazon-inspector (eb0b278fa833e7d9d9b054a90f8b5454b7e8bb0a10c9dd1c3a3a0e452ccefa43)