lufxchwmxwyps@1.0.0

Analysis

The package ships a single static HTML page that impersonates a Cloudflare "Just a moment..." Turnstile verification page. The page's inline JavaScript is obfuscated (encoded string array with a custom base64 decoder, an embedded AES key and host key) and renders a fake Turnstile challenge widget. When the visitor completes the challenge, the script invokes a redirect callback that sends them to an attacker-controlled destination. The page is a phishing-kit component intended to be served to victims to harvest credentials after a fake bot-check; the redirect target is obfuscated inside the script. The package has no install-time lifecycle scripts.