nsdhjuiwqxmhsf1@1.0.0
Vulnerability report · Last retrieved from osv.dev October 29, 2026 at 4:00 PM UTC
OSV ID
MAL-2026-17938
Ecosystem
npm
Summary
The package contains no JavaScript source, no TypeScript source, and no install/require lifecycle hooks. The sole shipped file is index.html, declared as the package main, containing Cloudflare Turnstile branding and a large obfuscator.io-style IIFE (hex-named identifiers, string-array dispatcher). Because main points at HTML rather than a Node-loadable module and no lifecycle scripts are defined, installing or requiring the package does not execute code on an npm installer. The structure is consistent with using the npm registry as a static hosting/CDN channel (e.g. via unpkg or jsDelivr) to serve a Cloudflare-impersonation page to browser visitors, rather than to attack developers who install the package.
Source: amazon-inspector (d9259b9f77730ae281a5467d21626b8ef91c6c41200acf321b28968b3d36c241)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.