unitel4 @1.0.0

Summary

Package contains only package.json and index.html, with main pointing at index.html. The HTML impersonates a Cloudflare 'Just a moment...' interstitial; its Turnstile callback runs obfuscated JavaScript that constructs a URL ending in a '.club/' domain, appends the current query string, and calls window.location.replace to redirect the browser. There are no preinstall/install/postinstall/prepare lifecycle hooks, and an HTML file cannot be executed via require()/import, so installing or loading this package in a Node.js build environment does not execute the redirect. The payload only fires when the HTML is served to and rendered by an end-user browser, indicating registry abuse to host a phishing/cloaking landing page rather than a supply-chain attack against developers who install the package.

Source: amazon-inspector (a5370545a3cd79dd914fd2af5c469caf0f8942c74c14f760f34c3f6856e6648d)