add-colors-to-website@1.0.3

No blocking static signals were detected.

Runtime import/execution in a browser document with a parent window.

Phishing/open redirect, navigation hijacking, and potential client-side disruption.

Parent-DOM script injection and dynamic external redirect.

When loaded, index.js creates a script in the parent document. That script extracts a host from the parent URL, redirects to its /join/org/ruVMZh4diDGLWa1t3c37hQ path after two seconds, and navigates another window to a very large query URL. This is unrelated to the package name and provides a concrete browser hijack chain.

Direct source inspection confirms immediate, concealed navigation behavior with a dynamically selected external host and no color-related implementation. This is concrete malicious runtime behavior, not a static hint.