nhdxzthponv5 @1.0.0

Summary

Package nhdxzthponv5@1.0.0 has a random name, no description/author/repo/dependencies/lifecycle scripts, and its 'main' points at index.html with 'files' shipping only that HTML. The HTML impersonates a Cloudflare Turnstile 'Just a moment...' challenge (real Turnstile sitekey 0x4AAAAAADrvn4rDM7WVvgPh, randomly-generated fake Ray ID). Heavily obfuscated JavaScript (obfuscator.io-style string-array rotator, RegExp-based debugger self-defense, console-method hooking) fires on Turnstile callback, constructs a URL on a '.cloud.homes' host, forwards the current page's query parameters via URLSearchParams, and navigates window.location to that URL. The package provides no library API; its sole purpose is to use the npm registry and its public CDN (unpkg/jsdelivr) as free hosting for a browser-targeted phishing/redirect page. Victims are end users who land on the CDN URL, not typical npm install consumers, but the artifact is malicious content published to npm and should be removed.

Source: amazon-inspector (6436b46b4e05feabab19a551bd470495e4d8fc9dfef7e42a01bd527054b1b07d)