cvmbxcjiasdg @1.0.1

Summary

The package contains a single index.html file declared as main and no JavaScript entry point, lifecycle scripts (preinstall/install/postinstall/prepare), or library exports. The HTML mimics a Cloudflare 'Just a moment...' Turnstile challenge and embeds obfuscator.io-style JavaScript with a custom base64 string array. When the fake challenge completes, decoded strings are used to construct a URL via new URL(...) , the current page's query parameters are forwarded via URLSearchParams(window.location.search).forEach(...targetUrl.searchParams.append...) , and the browser is navigated with window.location.replace(targetUrl.toString()) . The redirect only executes in a browser that renders index.html; npm install and require() of this package run no code and touch no installer resources. The artifact appears to be an abuse of the npm registry as a static host for a phishing/redirect lure rather than an attack on developers installing the package.

Source: amazon-inspector (925628ce795fdbf222c292ae4ccfbe710eda2fa1b6fd521db3379f9569e16f9b)