mnhdjoweuq @1.0.0
Vulnerability report · Last retrieved from osv.dev August 13, 2026 at 4:27 AM UTC
OSV ID
MAL-2026-13822
Ecosystem
npm
Summary
Package contains only package.json and index.html, with main pointing at the HTML file. index.html mimics a Cloudflare Turnstile 'Just a moment' challenge and contains an obfuscator.io-obfuscated Turnstile callback that reconstructs a URL starting with 'https://lo' from a string-array and navigates the browser to it via window.location. There are no install lifecycle scripts (preinstall/install/postinstall/prepare) and main is HTML rather than JavaScript, so nothing executes on npm install or require of the package. The obfuscated redirect only fires when a browser loads the HTML (for example if served via a CDN like unpkg/jsdelivr), affecting a browser visitor rather than the developer who installs the package.
Source: amazon-inspector (095b631b3ea82334aa5d3ffb4c015340670beebb533d0e016023d997a3ce7e56)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.