passport811@1.0.0

Analysis

The package ships a single static HTML page that impersonates a Cloudflare "Just a moment..." Turnstile bot-verification challenge. When a visitor completes the fake widget, an obfuscated script redirects the browser to crypt[.]microsoft[.]live/ and forwards the current page's full query-string parameters (commonly OAuth authorization codes, session tokens, and auth state) to that host. The domain impersonates Microsoft and is not a legitimate Microsoft endpoint. This is a phishing redirect kit designed to harvest session credentials from victims who land on it.