ndmckauxuoincv@1.0.0

Analysis

The package ships a single obfuscated HTML page disguised as a Cloudflare Turnstile "challenge" page (Traditional Chinese). When a victim is redirected to it, the page presents a fake Cloudflare verification widget while its obfuscated JavaScript reads the victim's URL query string (which commonly carries auth codes and session tokens) and exfiltrates those parameters to an attacker-controlled endpoint, encrypting the harvested data with AES using a hardcoded key. The page also decodes an embedded base64 payload. This is a credential/session-harvesting phishing kit: the URL parameters are collected and sent off-host.