afhmxiewpsf@1.0.0

Analysis

The package ships a single index.html that impersonates a Cloudflare Turnstile "Performing security verification" bot-check page. When a visitor completes the fake challenge, the onTurnstileComplete callback — obfuscated with a base64 string-array decoder, a Function-constructor string builder, and embedded AES key material — assembles a remote URL beginning with hxxps://ap[.][.]. and transmits the Turnstile token and page data to that remote endpoint. The page is a credential/token-harvesting phishing page: it presents a legitimate-looking Cloudflare challenge solely to capture the token and exfiltrate it to the attacker-controlled host.