mnchfnvbue1 @1.0.0
Vulnerability report · Last retrieved from osv.dev August 13, 2026 at 4:27 AM UTC
OSV ID
MAL-2026-13821
Ecosystem
npm
Summary
The tarball contains a single file, index.html, declared as the package main. The HTML contains heavily obfuscated JavaScript that mimics a Cloudflare 'Just a moment...' interstitial and, after a 1-second timeout, decodes a string-array to build a URL and calls window.location.replace to navigate a browser to that URL. There are no npm lifecycle scripts (preinstall/install/postinstall/prepare), no bin entry, and main points at a non-JavaScript file, so npm install and require() do not execute this code on an installer's machine. The redirect only fires in a browser rendering the HTML. The package appears to be registry abuse (using npm to host an obfuscated browser redirect asset) rather than a supply-chain attack against installers.
Source: amazon-inspector (ff948b6e989a38a47cbb12d4e633d48a2069c04bb64066d66140f3b27835ef86)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.