ms_aidc_com_tw@1.0.0

Analysis

The package ships a single index.html that is a Cloudflare Turnstile "Performing security verification" bot-check interstitial page for the domain ms[.]aidc[.]com[.]tw. The page loads the Cloudflare Turnstile challenge and, on completion, redirects the browser to the target origin. It is a phishing-kit component distributed as an npm package: the package declares no functional code and serves only as a hosted phishing interstitial for the ms[.]aidc[.]com[.]tw domain.