hxckdoeaqjlc8 @1.0.0
Vulnerability report · Last retrieved from osv.dev August 13, 2026 at 4:27 AM UTC
OSV ID
MAL-2026-13816
Ecosystem
npm
Summary
The package ships a single HTML file that impersonates Cloudflare's 'Just a moment...' interstitial. On Turnstile widget callback, embedded JavaScript reconstructs the URL 'https://checkout.microlive.club/' from concatenated string fragments and calls window.location.replace to redirect the visitor to that host, forwarding any inbound query-string parameters via URLSearchParams. package.json declares no lifecycle scripts and 'main' points at the HTML file, so nothing executes on npm install or require. The artifact is a phishing/redirect landing page abusing the npm registry as static hosting; the target audience is browser visitors served this file elsewhere, not developers who install the package.
Source: amazon-inspector (d324cd3fd06a0d97ae5fb9263df818bc505d28ebcdda8e90814b5630de70e108)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.