ndmcmsujey@1.0.0

Analysis

This npm package ships a single static HTML file that reproduces a Cloudflare "Just a moment..." Turnstile challenge page. The embedded JavaScript is heavily obfuscated with an encoded string array and a custom decoder. The package declares no lifecycle scripts and no executable entry points, so it performs no action at install time; as a browser-facing page it renders a Turnstile challenge widget. No credential submission, cookie access, or outbound data transfer beyond the Cloudflare Turnstile endpoint was identified in the shipped code.