mnteckets@1.0.1

Analysis

mnteckets@1.0.1 ships a single index.html that impersonates a Cloudflare "Performing security verification" Turnstile bot-check page. When a visitor completes the challenge, a heavily obfuscated callback (encoded string array with a custom base64 decoder) assembles a target URL and redirects the browser to it via window.location.href. The package is a phishing redirector: it presents a fake Cloudflare challenge and silently forwards the victim's browser to an attacker-controlled destination. The destination URL is obfuscated inside the encoded string array.