egair0810 @1.0.1

Summary

The package contains a single index.html file declared as the package main , presenting a fake 'Just a moment...' / Cloudflare Turnstile page with heavily obfuscated JavaScript (string-array + shuffling style) that constructs a target URL from encoded strings and calls window.location.replace to redirect the browser. package.json declares no preinstall, install, postinstall, or prepare lifecycle scripts, and main points at an HTML file that Node cannot load as a module, so npm install and require() of the package do not execute the obfuscated code. The payload only runs if the HTML is opened in a browser. The artifact is not a functioning npm library and appears to be registry abuse hosting a browser-facing redirect/phishing lure rather than a supply-chain attack against developers who install the package.

Source: amazon-inspector (2778f49499126b52d7dc9bbf728ed62bc8177ea325300c7907f2a4b854436507)