passport811 @1.0.0

Summary

passport811@1.0.0 contains a single HTML file that impersonates a Cloudflare Turnstile 'Just a moment...' challenge. After the Turnstile callback fires, obfuscated JavaScript assembles a redirect URL to the Microsoft typosquat host microsofte.live (host string built at runtime from an obfuscator.io string-array lookup concatenated with the fragments 'ypt.micros' and 'ofte.live/') and calls window.location.replace() to send the browser there, forwarding the current query string. The package has no library or CLI surface and no lifecycle scripts — the HTML is not executed by npm install or by require() . The artifact is a hosted phishing kit distributed via the npm registry rather than code that attacks the machine performing the install.

Source: amazon-inspector (e96b8ce5a6dee87674b66e3aad6e3cf750c6e24243dd564922ff7b68be2f48b8)