mx3dxhgic8xhd6@1.0.1

Summary

Package mx3dxhgic8xhd6@1.0.1 is published under a random-looking short name with only two files, one of which is an index.html containing a large obfuscator.io-style JavaScript payload. The script uses hex-named identifiers (_0x...), a ~500-entry shuffled string array returned by a decoder function, a rotating-array decoder loop, and runtime atob / String.fromCharCode calls, so no destination URLs, API endpoints, or data sinks are visible as plain text. The code's actual runtime behavior (network destinations, DOM injection, redirect/clipboard/credential sinks) cannot be determined without executing or de-obfuscating the payload. The shape — nonsense package name, HTML-as-payload, heavy string/control-flow obfuscation hiding all destinations — is consistent with phishing/ClickFix-style delivery pages rather than a conventional npm library.

Source: amazon-inspector (6c4fbf379ad5f6f1c43cb74ef7fbc66e56fe9b0c0edeaffd1f51bb9e5558c2bb)