clxofwfjskaz7 @1.0.0
Vulnerability report · Last retrieved from osv.dev August 14, 2026 at 6:32 AM UTC
OSV ID
MAL-2026-13794
Ecosystem
npm
Summary
The tarball contains only package.json and index.html. package.json declares main: index.html and no lifecycle scripts (preinstall/install/postinstall/prepare). index.html renders a fake Cloudflare 'Just a moment...' interstitial and, on Turnstile callback, runs obfuscator.io-style JavaScript that constructs a URL and calls window.location.assign to redirect the browser. Node cannot load an HTML file as a module, so nothing executes on npm install or on require of this package. The abuse surface is browsers that load this HTML via an npm-backed CDN (e.g., unpkg), not developers installing the package.
Source: amazon-inspector (8b4dde997a29794d4dfbb4725da833fa7cb4a221dc91d6b820901745eb77f198)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.