mnteckets @1.0.1

Summary

The tarball contains only package.json and index.html. package.json declares no lifecycle scripts (preinstall/install/postinstall/prepare) and sets main to index.html, which Node cannot execute via require()/import. index.html mimics a Cloudflare Turnstile challenge and, on the challenge callback, builds a redirect URL via obfuscated string concatenation (new URL('https://mi'+...)) and calls window.location.assign to navigate the browser away. The redirect only fires when a user opens the HTML file in a browser; installing or requiring the package from Node performs no code execution and reads no installer data. The package appears to be registry-hosted phishing/redirect content rather than a supply-chain attack against npm installers.

Source: amazon-inspector (caa458e1b7c6ca828e971aa0dac44b11b2f20aaf55652235ce2a4c5ce1c4fd66)