Threats Tagged 'mal-2026-13803'

The npm package 'dzcvhfruwluwe' versions 1.0.0 and 1.0.1 contains a malicious index.html file that acts as a fake 'Cloudflare Verifying...' page. This page uses obfuscated JavaScript to redirect users' browsers after a short delay to an attacker-controlled external domain. The malicious behavior is client-side and does not execute during package installation or require-time, meaning it does not compromise the developer's environment directly. However, end users who load the HTML file in a browser are redirected to potentially harmful sites. This is a case of registry abuse hosting phishing or malvertising content rather than a traditional supply-chain attack. There is no CVSS score available for this threat. The package should be removed, and any secrets on compromised machines should be rotated due to the risk of full compromise.