jkbnwsdf8 @1.0.2

Summary

The package contains a single file, index.html, declared as the package main . The HTML is styled as a Cloudflare Turnstile 'Just a moment...' challenge page and contains obfuscator.io-encoded JavaScript that, after a Turnstile callback, constructs a redirect URL from a fragmented literal ( 'https://lo' + <decoded> + / ) and calls window.location.assign(targetUrl) , forwarding the caller's query string. There is no package.json lifecycle script (no preinstall/install/postinstall/prepare) and no JavaScript main entry, so npm install and require() of this package do not execute any code on the installer's machine — Node cannot execute HTML. The redirect only fires against browser end-users who load the HTML through an npm CDN such as unpkg or jsdelivr, which is outside the installer-protection scope of this engine. The package is abusing npm as a static-hosting CDN for what appears to be a redirect/cloaking page and warrants a registry-abuse takedown, but it does not attack developers or build systems that install it.

Source: amazon-inspector (8e67b8d2fe8ba4fcec395d1fa7497515b41f2e4edc7f25e12c2b4b4abcebe358)