csbcldfvivwfgd4 @1.0.0

Summary

The package contains a single index.html declared as main . The HTML mimics a Cloudflare 'Just a moment...' challenge and contains obfuscator.io-style control-flow-obfuscated JavaScript that constructs a redirect URL from a rotated string array and calls window.location.replace(targetUrl). There are no lifecycle scripts (preinstall/install/postinstall/prepare) and main pointing at an HTML file means require() cannot load it, so nothing runs on npm install or on import in a Node.js developer/build environment. The harmful behavior only fires when the HTML is fetched by a browser via an npm-backed CDN (unpkg/jsdelivr) and rendered — i.e., abuse of the npm registry as a hosting/CDN for a phishing or malvertising redirect page targeting browser end-users, not developers who install the package. Under this system's installer-centric threat model, installing or requiring this package produces no exfiltration, no code execution, no credential access, and no persistence on the installer's machine.

Source: amazon-inspector (f6d7db017a0499c0fca67cc331c44fa736fe52568177990823cb17bd03ceee21)