fhj8cv9dkwm4 @1.0.0
Vulnerability report · Last retrieved from osv.dev August 13, 2026 at 4:27 AM UTC
OSV ID
MAL-2026-13809
Ecosystem
npm
Summary
Package ships a single index.html that mimics a Cloudflare Turnstile 'Just a moment...' verification page. An obfuscated (obfuscator.io-style) script assembles a .club URL at runtime from string-array lookups, copies the current page's query parameters onto it, and navigates the browser to that URL via window.location . The package declares no JS main, no bin entry, and no lifecycle scripts ( preinstall / install / postinstall / prepare ), and contains no binding.gyp , so npm install and require() of this package do not execute any code on the installer's machine. The redirect logic only runs in a browser that renders index.html — for example, if the file is served from a CDN or hosting surface fronted by the npm registry.
Source: amazon-inspector (f91ea4120fcb82c9a36d533346c28a2ce7ed225ed31a89526d9cee45f0be2581)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.