@worrisome/aaaa@1.0.0

Analysis

Ships a single index.html that is a fake Cloudflare "Just a moment..." Turnstile challenge page. The page's inline script is heavily obfuscated (string-array decoder, base64 decoding, an embedded AES key) and, on Turnstile completion, invokes a redirect callback (window.__challengeRedirect) — a phishing-kit pattern used to harvest the Turnstile token and redirect victims to a phishing destination. The package declares no lifecycle scripts, so the page does not execute on npm install, but the shipped artifact is a credential-phishing page.