oprnm@1.0.0

Analysis

oprnm@1.0.0 is a Microsoft credential-phishing kit distributed via npm. It serves a two-stage client-side page: Stage 1 is a fake "Micro-Share" document-sharing UI prompting a Download click; Stage 2 renders a counterfeit Microsoft sign-in page that collects the victim's credentials and redirects the browser to login[.]siemens-energy[.]icu. The page disables right-click/copy/paste, checks for headless browsers (navigator.webdriver, plugin count, screen dimensions), and includes honeypot fields. It has no lifecycle hooks and does not run on install; it is a static phishing template meant to be served as a web page to steal end-user Microsoft credentials.