xsjukcnv8low26@1.0.0

Analysis

xsjukcnv8low26@1.0.0 ships a single obfuscated index.html that impersonates a Cloudflare Turnstile "Performing security verification" challenge page. It embeds a real Turnstile sitekey and, in the onTurnstileComplete callback, runs a javascript-obfuscator-encoded payload that decodes a base64 string array, constructs a host key and an AES key, and POSTs JSON to a remote host — exfiltrating the solved Turnstile token (and any accompanying data) over an encrypted channel. The C2 destination is concealed inside the obfuscated string array (base64-encoded URL fragments). The package has no functional purpose beyond this token-harvesting page.