nhdxzthponv5@1.0.0

Analysis

The package ships a single index.html that presents a Cloudflare Turnstile "Performing security verification" bot-check page. The page's onTurnstileComplete callback contains heavily obfuscated JavaScript (an encoded string array with a base64 decoder, Function-constructor execution, and a prototype-pollution loop over built-in object names) that runs when a visitor completes the challenge. This is a credential-harvesting phishing page: the fake bot-check executes obfuscated code on the visitor's browser. The obfuscated payload's destination is not visible in the static source.