luftmvfiwgxydes@1.0.0

Analysis

The package ships a single heavily-obfuscated HTML file that impersonates a Cloudflare "Just a moment..." Turnstile challenge page. The page is a phishing kit: its obfuscated JavaScript builds a fake Turnstile challenge, embeds AES-key and host-key constants, decodes base64 payloads, and reads and forwards URL query parameters (visitor params). It is designed to be served to victims to run them through a fake challenge flow and harvest credentials. The package has no install scripts and no dependencies; the malicious artifact is the bundled phishing page itself.