The 'bgncvhferucfds' npm package consists solely of an obfuscated HTML file declared as its main content. When accessed via a browser, it renders a fake Cloudflare Turnstile 'Just a moment...' verification screen, then reconstructs and redirects to a URL at login.microsoft.com with the current page's query parameters. This redirection is designed to phish Microsoft credentials by masquerading as a legitimate login flow. The package does not contain lifecycle scripts or JavaScript entry points, so installation or requiring the package does not trigger execution. The malicious intent is to use the npm registry and its CDN mirrors as free hosting for this phishing lure. According to a malware source, any system with this package installed or running should be considered fully compromised, necessitating immediate secret and key rotation from a clean system.

The package enables credential phishing by redirecting users to a fake Microsoft login page, potentially leading to credential theft. Although the package does not execute code during installation or require, the presence of the package on a system indicates a high risk of compromise. The malware source warns that any computer with this package installed or running should be considered fully compromised, implying potential unauthorized access and control. Secrets and keys stored on affected systems are at risk and must be rotated immediately.

No official patch or fix is available. The package should be removed immediately from any affected systems. All secrets and keys stored on compromised machines should be rotated from a different, clean computer. Since the package does not execute during installation, developers installing it are not directly attacked, but caution should be exercised to avoid loading the package content in a browser. Monitor for and avoid installing suspicious or unknown npm packages. Patch status is not yet confirmed — check the vendor advisory or npm security advisories for updates.