fdhcvriwecv3 @1.0.0

Summary

The tarball contains only package.json and index.html. package.json declares main as index.html, and there are no preinstall/install/postinstall/prepare scripts. index.html mimics a Cloudflare 'Just a moment...' interstitial and runs obfuscated JavaScript inside a 1-second setTimeout that constructs a URL pointing at a '*.cloud.homes' host and calls window.location.replace() with the current query string forwarded. Because main points at HTML, the module cannot be loaded via require()/import, and no JavaScript executes at npm install time or when the package is required. The behavior only fires if a browser fetches index.html through a public npm CDN (unpkg/jsdelivr) — a CDN-abuse / phishing-hosting pattern that leverages npm as a redirector host, not a supply-chain attack against developers who install the package. No credentials are read, no network callbacks fire on install/import, and no code runs on the installer's machine.

Source: amazon-inspector (c72894ed6ed82e4ebcbd83619b2a3f591c7dab355050fc1d43a62f90d384ee08)