skxcmwuncbg2@1.0.0

One or more suspicious static signals were detected.

User opens index.html and the Turnstile callback runs.

Arbitrary remote phishing or malware content can be selected after publication; URL query data is forwarded.

Obfuscated remote payload retrieval, decryption, and browser redirect

The package declares an HTML file as its only entrypoint. That file presents a Cloudflare-style verification screen and invokes an obfuscated callback after the challenge. The callback posts to a concealed endpoint, decodes and decrypts its response into a URL, copies current query parameters to that URL, then navigates the browser there. This is a staged, remotely controlled redirect chain concealed behind a verification lure.

Source inspection confirms a concealed remote-controlled redirect chain rather than a legitimate npm package function. The hidden destination and encrypted response prevent review of the eventual payload.