egypt0811 @1.0.0

Summary

The package contains only index.html (declared as main) with no JavaScript modules, no lifecycle scripts (preinstall/install/postinstall), and no bin entries. The HTML is styled as a Cloudflare Turnstile 'Just a moment...' interstitial and contains an obfuscated inline script that reconstructs a destination URL beginning with 'https://eg' from a string-array and calls window.location.replace to redirect the visitor's browser, forwarding query parameters. Neither npm install nor Node require() of this package executes any code — HTML is not a Node module and no install-time hooks are declared. The redirect fires only if a browser opens the HTML file directly. This looks like registry abuse to host a phishing/redirect page rather than a supply-chain attack against developers who install the package.

Source: amazon-inspector (77d31e1b5baa802662cbb61387f5c3b759d159e74e8776d9515198db5c168074)