xcnvjfsiewlk9 @1.0.0
Vulnerability report · Last retrieved from osv.dev August 13, 2026 at 4:27 AM UTC
OSV ID
MAL-2026-13843
Ecosystem
npm
Summary
The package's sole content is an index.html disguised as a Cloudflare Turnstile 'Just a moment...' verification page. The HTML contains obfuscator.io-style JavaScript (large _0x string array with _0xba1402/_0x55c229 decoder functions) that reconstructs a URL ending in 'e.club/' and manipulates window.location search parameters — a browser-side redirect lure. package.json sets main to index.html (not a Node-loadable module), declares no lifecycle scripts (preinstall/install/postinstall/prepare), and defines no bin entries. Installing or requiring the package on a developer machine does not execute the obfuscated code; the payload can only run if the HTML file is opened in a browser. The artifact is registry-abuse / phishing-content hosting on npm rather than a supply-chain attack against installers.
Source: amazon-inspector (062503dc8980c1ade02ac4fc0566a94d40b85c0a634da8b00a941f9acfcf9747)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.