dsjklweuvhgsdcq@1.0.1

Summary

The package contains no JavaScript entry point, no lifecycle scripts, and no dependencies. Its only shipped file is an HTML page titled 'Just a moment...' that mimics a Cloudflare Turnstile challenge and embeds a large obfuscator.io-style inline script (hex-encoded string array, _0xXXXX identifiers). The package.json main field points at this HTML file, so require() or import of the package from an installer resolves to a non-executable asset and performs no action at install, import, or require time. The artifact's shape is consistent with using the npm registry (and downstream CDNs such as unpkg/jsDelivr) to host a browser-side phishing / ClickFix-style lure page targeting end users who load the HTML via a CDN URL, rather than developers who install the package.

Source: amazon-inspector (a374493c76cce0d4d3b1358003a3fbbb6ad103113a386966045d5bae0892a82c)