cjdfswifuem3 @1.0.0

Summary

The package has no JavaScript module; package.json declares main as index.html, which cannot be require()'d, so installing or importing this package produces no code execution on the installer. The sole shipped content is an index.html that renders a fake 'Performing security verification' page impersonating a Cloudflare Turnstile challenge, then after ~1s executes obfuscator.io-style code (rotating string array _0x5d5d, base64 decoder _0x92a0 with self-defense anti-debug class, indirect accessors) that constructs a URL and calls window.location.replace(targetUrl.toString()), forwarding the visitor's query parameters to a destination that is not readable in the shipped source. The only in-clear URLs are decoy cloudflare.com footer links used to sell the disguise. The npm registry is being abused as a hosting/distribution channel for a phishing-lure page rather than as a code package. Installers who run npm install cjdfswifuem3 are not attacked (no lifecycle scripts, no importable code, no credential access); the victims are end users who reach the hosted HTML via a phishing link. This is registry abuse warranting takedown but is not an installer-side supply-chain attack under this engine's threat model.

Source: amazon-inspector (565ffd2f5127412df02a03f80345ff2420dc5545b65abff5298eac3bf1bf2990)