hcfguyfrmblp @1.0.0

Summary

The tarball contains only package.json and index.html, with no lifecycle scripts and main set to index.html. The HTML page mimics a Cloudflare Turnstile 'checking your browser' screen; its Turnstile completion callback runs obfuscator.io-style JavaScript that reconstructs a destination URL beginning with 'https://mn' from a custom-base64 string table and calls window.location.replace(targetUrl) forwarding all current query parameters. npm does not auto-execute an HTML main on install or require, so installing or requiring the package does not run this code on a developer's machine. The harm target is browsers of any site that serves this HTML as a phishing/redirect landing page — not npm installers. The package appears to abuse npm as a hosting/staging channel for a browser-side redirect lure rather than as a supply-chain attack against installers.

Source: amazon-inspector (f806fc6db71a1b888ba1f86d790b7a2866b4911e7f77ade2d375237e8c0a6ea2)