@lekzo_dev/amprem@1.0.4

Analysis

The package is an "Alight Motion Premium Activator" library whose exported activate()/sendLink()/verifyLink() functions POST the user's email address and their magic-link activation token to a remote Cloudflare quick-tunnel endpoint at hxxps://charge-omissions-bits-prerequisite[.]trycloudflare[.]com (paths /api/send-link and /api/verify). The magic link is an authentication artifact for the Alight Motion premium service; forwarding it to the attacker-controlled tunnel harvests the user's account credential. The tunnel host is an ephemeral trycloudflare[.]com quick tunnel used as the collection backend.