MAL-2026-13793 Malicious code in cjdfswifuem3 (npm)

The package has no JavaScript module; package.json declares main as index.html, which cannot be require()'d, so installing or importing this package produces no code execution on the installer. The sole shipped content is an index.html that renders a fake 'Performing security verification' page impersonating a Cloudflare Turnstile challenge, then after ~1s executes obfuscator.io-style code (rotating string array _0x5d5d, base64 decoder _0x92a0 with self-defense anti-debug class, indirect accessors) that constructs a URL and calls window.location.replace(targetUrl.toString()), forwarding the visitor's query parameters to a destination that is not readable in the shipped source. The only in-clear URLs are decoy cloudflare.com footer links used to sell the disguise. The npm registry is being abused as a hosting/distribution channel for a phishing-lure page rather than as a code package. Installers who run npm install cjdfswifuem3 are not attacked (no lifecycle scripts, no importable code, no credential access); the victims are end users who reach the hosted HTML via a phishing link. This is registry abuse warranting takedown but is not an installer-side supply-chain attack under this engine's threat model.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.