The 'bmgki3g6fh3' npm package (version 1.0.0) includes a single file, index.html, declared as its main entry point. This HTML page mimics a Cloudflare 'Just a moment...' or Turnstile security verification interstitial, including a fake Ray ID and a real Turnstile widget. Upon user interaction, an obfuscated script dynamically assembles a URL and redirects the browser to it, potentially leading to phishing or malicious sites. No lifecycle scripts (preinstall, install, postinstall, prepare) are present, and no JavaScript code executes during npm install or require(), so the malicious behavior only triggers when the index.html page is loaded in a browser. This represents registry abuse for hosting phishing or redirect infrastructure rather than a supply-chain attack targeting developers or build systems.

Users who open the index.html file in a browser may be redirected to malicious URLs, potentially exposing them to phishing attacks or other web-based threats. However, installing or requiring the package in a development environment does not trigger malicious code execution. Despite this, the ghsa-malware source warns that any computer with this package installed or running should be considered fully compromised, recommending immediate rotation of all secrets and keys. This suggests that the package may be part of a broader compromise or that additional malicious payloads could be present beyond the described behavior.

Remove the 'bmgki3g6fh3' package version 1.0.0 from all systems. Rotate all secrets and keys stored on any affected machines from a separate, trusted device. Since the malicious behavior only manifests when the index.html is loaded in a browser, avoid opening this file or any related URLs. There is no official patch or fix available; the package itself is malicious and should be considered untrusted. Monitor for any signs of further compromise and conduct a thorough security assessment of affected systems.