GCVE-110-OSM-2026-13892

This package is almost certainly phishing infrastructure. The entrypoint is a fake Cloudflare Turnstile challenge page containing 88KB of heavily obfuscated JavaScript (obfuscator.io-style _0x hex variable encoding, string-array rotation), which is a well-documented technique used to conceal redirect logic and credential-harvesting payloads behind a plausible security UI. The publisher 'pckzbtyl' has already had one package (nsdhjuiwqxmhsf1) confirmed critical-malicious, exhibits a classic burner-account pattern (4-day-old account, 7 random-named packages, rapid version spam at 113 versions/day), and has a sibling package named 'ticketcathayoct12' that strongly suggests the campaign targets Cathay Pacific airline ticket purchasers — a common phishing theme. The npm package exposes an HTML file as its 'main', which is not a legitimate npm library pattern and confirms this is infrastructure-as-package rather than a developer tool. The recovered IOC fragments ('https://w' and 'are.com') suggest URL construction hidden inside the obfuscated payload that the truncated analysis could not fully recover. ENTRY index.html (main: index.html) OBFUSCATION - Unicode Escape Obfuscation in index.html: "\x20\x20\x20\x20\x20\x20\x20\x20\x20\x20" ADDITIONAL FINDINGS - Very New NPM Publisher Account - Publisher Has Other Malicious Packages - Publisher Shows Burner-Account Pattern - Rapid Version Publishing