luftzxyuiwgbgsp@1.0.0

Analysis

The package ships a single obfuscated index.html that impersonates a Cloudflare "Just a moment..." Turnstile bot-check page. The page is obfuscated with a large encoded string array and a custom decoder, embeds hostKey/aesKeyBase64/turnstileSiteKey constants, reads the visitor's URL query parameters, and on Turnstile completion invokes a __challengeRedirect handler that redirects the visitor to a phishing destination. It is a credential-harvesting page designed to trick users into completing a fake challenge and being redirected to a malicious site.