dzcvhfruwluwe@1.0.0

Analysis

The package ships a single index.html that clones Cloudflare's "Just a moment..." security-verification page. One second after the page loads, obfuscated JavaScript builds a URL on the attacker-controlled domain ofte[.]live, copies every query parameter from the current page URL onto it, and redirects the browser there. The page is a phishing lure: it impersonates a bot-check to harvest the victim's URL parameters (auth codes/tokens) and forward them to the attacker's domain.