zxhgssiyluwxchn@1.0.0
Vulnerability report · Last retrieved from osv.dev October 29, 2026 at 4:00 PM UTC
OSV ID
MAL-2026-17941
Ecosystem
npm
Summary
The package consists of a single index.html file set as main. The HTML renders a Cloudflare 'Just a moment...' Turnstile challenge page and contains heavily obfuscated JavaScript (string-array decoder functions _0x3c31/_0x3bf2, hex-indexed calls) that reconstructs a destination URL at runtime, concatenating a decoded prefix with the suffix 'dflare.com' to impersonate the real cloudflare.com domain. There are no lifecycle scripts (preinstall/install/postinstall/prepare), no JavaScript entry point, and because main points at HTML, require()/import of this package from Node cannot load or execute the obfuscated code. Installing this package does not run the payload on the installer's machine; the harm model is browser-side phishing of end users who fetch the HTML via an npm CDN proxy (unpkg/jsdelivr), using the registry as free static hosting for a Cloudflare-impersonation landing page.
Source: amazon-inspector (d4ec9075865f87bed709b7be203b621244e13b28d84e8bd47586d2df02e30a24)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.