cjlowuxbnexkhgpzq@1.0.0

Summary

Package contains only index.html (declared as main) and no JavaScript, no lifecycle scripts, and no other files. The HTML is a Cloudflare-styled page that fetches an AES-encrypted value from api.keyval.org under a fixed key, decrypts it to obtain a destination host, calls <host>/api/strategies/check?cid=... and then redirects the browser via window.location.replace to a policy-selected target. The content is designed for browser visitors loading the page over HTTP, not for Node.js installers: npm install runs no code, and require() of an HTML main is a no-op or parse error. The package appears to misuse the npm registry as hosting for a traffic-distribution/cloaking landing page; any harm is to end-users who load the page, not to developers who install or import the package.

Source: amazon-inspector (06d1d7f624932b32c72ee705c215fadc8c0d4840b7102b390674f2df1fedbb92)