twcvhjlksdmx @1.0.1

Summary

The tarball contains only package.json and index.html. package.json declares no preinstall/install/postinstall/prepare lifecycle hooks and sets main to index.html, which is not a loadable JavaScript module and will not execute on npm install or on require(). index.html impersonates a Cloudflare 'Just a moment' interstitial and embeds an obfuscator.io-style script (string-array + base64 _0x5844 decoder) that constructs a URL and calls window.location.replace to redirect the browser. The redirect only fires if a user opens the HTML file in a browser; it does not run against a developer or build system that installs or requires this package.

Source: amazon-inspector (60b37bf3e91951e089b31d7aa6d31834fef110ba5bfc1c8c3cb09e701c9c1878)