vjkpwjxbvndelta@1.0.1
Vulnerability report · Last retrieved from osv.dev October 29, 2026 at 4:00 PM UTC
OSV ID
MAL-2026-17940
Ecosystem
npm
Summary
Package contains only index.html and a package.json declaring main: index.html. The HTML is a Cloudflare Turnstile 'Just a moment...' lookalike page carrying a heavily obfuscated inline script (IIFE with _0x-style identifiers at line 183). There are no preinstall/install/postinstall/prepare lifecycle scripts, no JavaScript source, and HTML cannot be require()'d, so installing or importing this package does not execute code on the installer's machine. The shape is consistent with abuse of the npm registry as static-asset hosting (e.g. serving the HTML via a public CDN mirror such as unpkg or jsDelivr) rather than a supply-chain attack against developers who install the package.
Source: amazon-inspector (b99400fad276cbcc12a4378e213d162e7992291ca714f3b410144f10d0c0ccaa)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.