fdhcxvnwhjiofv@1.0.0

Analysis

The package ships a single obfuscated index.html that impersonates a Cloudflare Turnstile "Just a moment..." challenge page. The inline script is obfuscated with a base64 string-array and custom decoder, and embeds AES key material, a Turnstile site key, and a base64-decoding helper. It renders a cloned Cloudflare challenge layout and wires the Turnstile completion callback to a redirect handler, forming a phishing kit designed to harvest Turnstile tokens and redirect visitors. The page is served to victims rather than executed at install (no lifecycle hook).