Loading npm security reports…
The only package payload is a heavily obfuscated web page that presents a Cloudflare-style challenge and redirects the visitor. The redirect destination and visitor parameters are resolved by opaque code.
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
index.htmlView on unpkg · L182A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
index.htmlView on unpkgOpening the entrypoint invokes an opaque callback after a Turnstile challenge completes.
index.htmlView on unpkg · L178The obfuscated script builds a destination URL, appends visitor parameters, and invokes a host-redirect routine.
index.htmlView on unpkg · L183The obfuscated script builds a destination URL, appends visitor parameters, and invokes a host-redirect routine.
index.htmlView on unpkg · L183The package declares an HTML document as its sole main entrypoint.
package.jsonView on unpkg · L2This report applies to ndmcjcxiebysfdb@1.0.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Source advisory published: .
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
index.htmlView on unpkg · L182A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
index.htmlView on unpkgOpening the entrypoint invokes an opaque callback after a Turnstile challenge completes.
index.htmlView on unpkg · L178The obfuscated script builds a destination URL, appends visitor parameters, and invokes a host-redirect routine.
index.htmlView on unpkg · L183The obfuscated script builds a destination URL, appends visitor parameters, and invokes a host-redirect routine.
index.htmlView on unpkg · L183The package declares an HTML document as its sole main entrypoint.
package.jsonView on unpkg · L2