bvdfhdfvnk3 @1.0.0

Summary

The tarball contains a single index.html declared as the package main , with no JavaScript entrypoint and no preinstall/install/postinstall/prepare lifecycle scripts. The HTML loads Cloudflare Turnstile and, on Turnstile completion, an obfuscator.io-packed script constructs a URL to campaigns.microlive.club and calls window.location.replace to redirect the browser there. Node.js cannot execute an HTML file as main , so nothing runs on npm install or on require() of this package. The redirect only fires if a browser directly opens the HTML file. This is npm being used as static hosting for a cloaked redirect page rather than code that harms installers.

Source: amazon-inspector (6fadba2f2b2bb1c3507b2559209c50677db3b20feb0c083333567dfe7fcbddc4)