tibcwmpoeafh@1.0.0

Analysis

The package ships a single static HTML file that is a Cloudflare Turnstile "Just a moment..." security-verification challenge page (loading the turnstile script from challenges[.]cloudflare[.]com with sitekey 0x4AAAAAADrvn4rDM7WVvgPh). It has no package scripts, no executable code, and no legitimate purpose: a random-string package name with no README or repository. The Cloudflare Turnstile challenge page is a phishing template used to present a fake bot-check to visitors, typically to harvest credentials or session data behind a security-verification facade. The package is inert on install but is a phishing-page artifact.