hlksdcixycvf @1.0.0

Summary

The tarball contains a single file, index.html, declared as the package main . The HTML renders a Cloudflare Turnstile-themed 'verification' page containing obfuscator.io-style JavaScript that, on Turnstile callback, reconstructs a target URL and calls window.location.replace to redirect the browser. package.json declares no preinstall/install/postinstall/prepare lifecycle scripts, and npm cannot require an HTML main , so installing or importing this package performs no code execution on a developer machine. The obfuscated redirect only fires if a human opens index.html in a browser and completes the Turnstile widget; the target audience is browser visitors, not npm installers. The package appears to be abuse of the npm registry as static hosting for an obfuscated redirector / likely phishing landing page rather than a supply-chain attack against installers.

Source: amazon-inspector (e91dec68a77b15daa1f923bcfe876d283a8fea8d8cdf3d2ea27888b8eb522b97)