ms_aidc_com_tw @1.0.0

Summary

The package ms_aidc_com_tw ships only an index.html that renders a fake Cloudflare Turnstile 'security verification' page. On Turnstile completion, heavily obfuscated JavaScript (obfuscator.io-style rotating string array _0x59f1 , RC4/base64 decoder _0x2020 , self-defending anti-debug checks) assembles a URL to login.microsoftonline.com , copies the current page's query-string parameters onto it, and calls window.location.replace to hand the victim off to Microsoft's real login with attacker-controlled parameters preserved — the standard adversary-in-the-middle / OAuth-consent phishing relay pattern. The package name impersonates a Microsoft-branded Taiwanese corporate domain ( ms.aidc.com.tw ). The obfuscation exists solely to conceal the phishing destination and the parameter-relay logic from casual review. The npm registry is being abused as hosting infrastructure for a Microsoft 365 credential-harvesting landing page.

Source: amazon-inspector (b12bdd45f103beeee602be82a07277a3f0cb842ec3a9829e904911fe37bd2fd5)