mnchfnvbue1@1.0.0

Analysis

The package ships a single index.html that clones a Cloudflare "Just a moment..." security-challenge page but injects an obfuscated script into it. One second after the page loads, the script reads the current page's URL query-string parameters and redirects the browser to an attacker-controlled URL, forwarding every query parameter along with it. This is a phishing redirector designed to harvest OAuth authorization codes, session state, or other tokens that travel in the URL query string. The destination URL is hidden behind a base64-encoded string array with a custom decoder.