tuxcmdfhjkw@1.0.0

Analysis

This npm package ships a single HTML file that impersonates a Cloudflare "Just a moment..." Turnstile verification page. When a visitor completes the fake challenge, an obfuscated script runs that reconstructs a host key and an AES encryption key from an encoded string array and executes a payload via the Function constructor. The payload harvests the Turnstile token and page context and transmits them to a remote server using the embedded host key and AES key for encrypted exfiltration. The package has no legitimate function: it is a credential/token-harvesting phishing page distributed through the npm registry.