vfgnhlkxchrd @1.0.1

Summary

vfgnhlkxchrd@1.0.1 contains a single HTML file (referenced as the package main) that mimics a Cloudflare 'Just a moment...' challenge. Embedded obfuscated JavaScript (hex-prefixed identifiers and a string-array dispatcher) reconstructs the URL https://config.microsofte.live/ from split string fragments and calls window.location.replace(targetUrl) on load. The domain config.microsofte.live is a typosquat of microsoft.live/microsoft.com. There are no lifecycle scripts and the main entry is an HTML file, so npm install and require() of this package do not execute the redirect against an installer; the payload only fires when the file is loaded in a browser via an npm CDN (unpkg/jsdelivr). The package is being used as free hosting for phishing infrastructure rather than as a Node module.

Source: amazon-inspector (e8d278c0d7ee5dd3f8e12e924051d7e4d77afc4e12b408e6cb1e089071fde5ec)