Malicious code in classroomhomework (npm)

The 'classroomhomework' npm package (version 1.0.0) includes an index.html file that mimics Google Classroom's UI as a decoy. Embedded JavaScript reconstructs a fragmented path to fetch a remote HTML/JS payload from a personal GitHub repository via jsDelivr. This payload is executed in the browser context using document.write, triggered automatically after page load and on user interaction. The obfuscation and decoy UI indicate deliberate concealment of the malicious delivery channel. Because the GitHub repository is not pinned to a specific commit, the attacker can modify the payload at any time, enabling dynamic remote code execution.

Any computer with this package installed or running should be considered fully compromised. The attacker may have obtained full control over the system, including access to stored secrets and keys. Immediate rotation of all credentials from a separate, uncompromised system is necessary. Removing the package alone does not guarantee removal of all malicious artifacts or backdoors introduced by the attacker.

Remove the 'classroomhomework' package immediately from all affected systems. Rotate all secrets, keys, and credentials from a different, trusted computer to prevent unauthorized access. Because the attacker may have persistent control, consider a full system audit and remediation. No official patch or fix is available; the package itself is malicious.