hngfykuvgh4 @1.0.0

Summary

Package contains a single index.html declared as main that impersonates a Cloudflare 'Just a moment…' verification page, embedding a real Turnstile widget and an obfuscator.io-obfuscated script. On any Turnstile callback (success, error, expired, timeout, unsupported), the script assembles a destination URL from a scrambled string array, appends the visitor's query-string parameters, and calls window.location.replace() to redirect the visitor. No package.json lifecycle scripts, no JS entrypoint, and HTML cannot be require()d — installing or importing this package does not execute code against a developer or build system. The artifact abuses the npm registry as static hosting for an end-user phishing/redirect lure (nonsense package name, no author metadata, Cloudflare-branded impersonation, obfuscated destination). Not a supply-chain attack against installers, but worth human review for registry-abuse takedown.

Source: amazon-inspector (eb74c94bd8f989f94db4ca0856a3b312b7bb3a71278fde98da36e42eda76bd4c)