china_airlines @1.0.0

Summary

The package china_airlines contains no JavaScript library code. Its package.json declares "main": "index.html" , and the shipped index.html is a fake Cloudflare 'Just a moment...' interstitial with a fake Turnstile widget and a dynamically generated fake Ray ID. The onTurnstileComplete handler is heavily obfuscated (obfuscator.io-style hex-named identifiers, rotating string array, self-defense wrappers) and decodes a hidden targetUrl from the encoded string table, forwards the current page's query parameters onto that URL via URLSearchParams(...).forEach , and calls window.location.assign(targetUrl) . A legitimate Cloudflare challenge does not decode its next-hop URL out of an obfuscated string array. The package appears designed to abuse npm plus its public CDN mirrors (unpkg / jsDelivr) as free hosting for a brand-impersonating phishing landing page; the victims are browser users who follow CDN links to the file, not developers who npm install it. The install/require surface itself is inert (no lifecycle scripts, no library code executed at install or import time), so there is no direct installer-side exfiltration, RCE, or credential theft.

Source: amazon-inspector (9a78be97ab9e11940bb49de80859b21f1de27b8f078bad4067b227fbc99d2413)