Loading npm security reports…
The declared browser entrypoint disguises an obfuscated redirect flow as a Cloudflare challenge. No npm install-time attack was identified.
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
index.htmlView on unpkg · L182A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
index.htmlView on unpkgThe entrypoint loads Cloudflare Turnstile while presenting a challenge page.
index.htmlView on unpkg · L9Obfuscated browser code appends visitor parameters and replaces the current page with a resolved remote URL.
index.htmlView on unpkg · L183The package declares an HTML file as its only main entrypoint.
package.jsonView on unpkg · L2This report applies to fdhcxvnwhjiofv@1.0.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Source advisory published: .
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
index.htmlView on unpkg · L182A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
index.htmlView on unpkgThe entrypoint loads Cloudflare Turnstile while presenting a challenge page.
index.htmlView on unpkg · L9Obfuscated browser code appends visitor parameters and replaces the current page with a resolved remote URL.
index.htmlView on unpkg · L183The package declares an HTML file as its only main entrypoint.
package.jsonView on unpkg · L2