The npm package bgzxcuite2 version 1.0.0 includes an index.html file styled as a Cloudflare Turnstile challenge with an obfuscated inline script. Upon completion of the Turnstile widget, the script reconstructs a URL from an encoded array and redirects the browser using window.location.replace. The package does not execute this payload during npm install or require/import because it lacks lifecycle hooks and JavaScript entry points. This behavior suggests the package is used as a hosting channel for browser-side redirects, likely for phishing or traffic monetization. The package does not compromise the system at install time, but the vendor advisory states any system with this package installed should be considered fully compromised, recommending immediate secret/key rotation and package removal.

The malicious redirect only triggers when the index.html file is opened in a browser, not during installation or runtime in Node.js environments. However, the vendor advisory considers any system with this package installed as fully compromised, implying potential additional undetected malicious activity or risk. Secrets and keys stored on the compromised system may be exposed, necessitating immediate rotation. Removing the package alone may not eliminate all malicious components if the system is compromised.

Remove the bgzxcuite2 package version 1.0.0 from all systems. Immediately rotate all secrets and keys stored on any affected machines from a separate, uncompromised system. Because the vendor advisory warns that full compromise is possible, conduct a thorough investigation and remediation of the affected systems beyond just removing the package. Patch status is not applicable as this is a malicious package rather than a vulnerability with an official fix.