cvbniydplwe3 @1.0.0

Summary

The tarball contains only index.html (declared as package.json main) and no JavaScript, no lifecycle scripts, and no Node-executable entry point. index.html renders a fake 'Just a moment...' Cloudflare Turnstile interstitial; on the Turnstile callback, an obfuscated string-array deobfuscator reconstructs a target URL and assigns it to window.location. HTML cannot be require()'d and there are no preinstall/install/postinstall hooks, so npm install and require('cvbniydplwe3') do not execute this code on the installer's machine. The behavior is a browser-side redirect that would only fire if the HTML were served from a CDN and loaded in a browser. This appears to be npm-registry abuse — parking phishing/redirect content in a package slot — rather than a supply-chain attack against installers.

Source: amazon-inspector (9edbef37139b40a366aacea90abbd4b80ca581921f213b98ffb17db3b857bfcd)