ndmcjcxiebysfdb@1.0.0

Analysis

The package ships a single obfuscated HTML page (index.html) that impersonates a Cloudflare Turnstile "please wait / security verification" challenge. The page loads the real Turnstile widget and embeds an AES key, a host key, and a Turnstile site key; once a visitor completes the challenge, the script redirects them to a phishing destination derived from those keys. It is a credential-harvesting phishing page distributed as an npm package.