hgdvfuflnb @1.0.0

Summary

Package hgdvfuflnb@1.0.0 contains a single file, index.html, declared as the package main. The HTML impersonates a Cloudflare 'Just a moment...' Turnstile challenge page (data-sitekey="0x4AAAAAADrvn4rDM7WVvgPh") and, on the Turnstile callback, runs an obfuscator.io-style string-array routine that assembles a target URL and calls window.location.assign(targetUrl). There is no JavaScript entry point, no lifecycle scripts (preinstall/install/postinstall/prepare), and no importable module — package.json declares main:"index.html" and files:["index.html"], so npm install and require('hgdvfuflnb') produce no code execution on the installer. The package is not a functional Node module; it is a browser phishing/redirector kit staged on the npm registry so the HTML can be fetched via public npm CDN mirrors (unpkg, jsdelivr). Installer-side impact is nil (no install-time or import-time code path), but the artifact abuses the registry as anonymous static hosting for hostile content aimed at end users who load the HTML through a CDN.

Source: amazon-inspector (dfc8e3c1c86c0f0589e1ab4d2a6e3f3a757b758c1f126e0d197f3924d9637922)