fghvbmniwu @1.0.1
Vulnerability report · Last retrieved from osv.dev August 13, 2026 at 4:27 AM UTC
OSV ID
MAL-2026-13808
Ecosystem
npm
Summary
Package contains a single index.html declared as main , which is a Cloudflare-branded 'Just a moment...' clone embedding a Turnstile widget and heavily obfuscated JavaScript (obfuscator.io-style _0x... identifiers, shuffled string array, control-flow flattening) that assembles a redirect URL at runtime and assigns it to window.location , forwarding the current query string. There are no preinstall/install/postinstall/prepare lifecycle scripts, and main points to HTML that Node cannot require or import, so installing or requiring this package does not execute code on a developer machine or build system. The behavior only affects a browser that loads this file via a CDN mirror (unpkg/jsdelivr), consistent with abuse of the npm registry as free CDN hosting for a phishing/redirect landing page rather than an attack on the installer.
Source: amazon-inspector (8623e3b9a84e8cbe5910bc3d683f19629c49b9d3f0a2e00ab771901efef8146a)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.