kamafhbnowct@1.0.0

Analysis

The package ships a single obfuscated index.html that is a fake Cloudflare Turnstile challenge page. It loads the real Cloudflare Turnstile API, collects the visitor's URL query parameters, generates a fabricated ray ID, and renders a fake "Performing security verification" interstitial. The page embeds an AES encryption key and a host key, and the collected visitor/browser data is encrypted before being sent to a remote host. The script is obfuscated with a large encoded string array and custom decoder, hiding the exact collection and exfiltration logic. This is a Turnstile phishing kit designed to harvest Turnstile tokens and visitor data from anyone who loads the page.