Loading npm security reports…
The sole package payload is an obfuscated browser page that gates a dynamically selected redirect behind a Turnstile challenge. No legitimate package functionality is present.
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
index.htmlView on unpkg · L182A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
index.htmlView on unpkgThe page loads Cloudflare Turnstile and invokes a redirect callback when the challenge completes.
index.htmlView on unpkg · L9The page loads Cloudflare Turnstile and invokes a redirect callback when the challenge completes.
index.htmlView on unpkg · L178An obfuscated inline script defines a policy redirect request using a caller-provided cid value.
index.htmlView on unpkg · L183The package declares index.html as its only published main file.
package.jsonView on unpkg · L2This report applies to ndmcjcxiebysfdb@1.0.2.
See version security history for other recorded verdicts.
Evidence last updated: .
Source advisory published: .
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
index.htmlView on unpkg · L182A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
index.htmlView on unpkgThe page loads Cloudflare Turnstile and invokes a redirect callback when the challenge completes.
index.htmlView on unpkg · L9The page loads Cloudflare Turnstile and invokes a redirect callback when the challenge completes.
index.htmlView on unpkg · L178An obfuscated inline script defines a policy redirect request using a caller-provided cid value.
index.htmlView on unpkg · L183The package declares index.html as its only published main file.
package.jsonView on unpkg · L2