khanbmnxls @1.0.0
Vulnerability report · Last retrieved from osv.dev August 13, 2026 at 4:27 AM UTC
OSV ID
MAL-2026-13820
Ecosystem
npm
Summary
The package contains a single index.html that impersonates a Cloudflare Turnstile 'Just a moment...' challenge page. The inline JavaScript is heavily obfuscated (obfuscator.io-style _0xNNNN identifiers and a shuffled string array) and assembles a redirect URL beginning with https://kh from decoded string fragments, wired to a fake data-sitekey and an onTurnstileComplete callback. The package declares no npm lifecycle scripts (no preinstall/install/postinstall/prepare), no JavaScript main , and no bin entry, so npm install and require() of this package do not execute the HTML or its embedded script. The harm surface is limited to a browser that renders the file directly; developers installing the package from npm are not attacked at install or import time. The artifact is a phishing/redirect lure hosted on the npm registry rather than a functional Node package.
Source: amazon-inspector (2170fddb23040b2e55eeeb17188244072efdef033879036b45865f5b84ef7346)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.