Malicious code in clickfix_npm_delivery (npm)

The 'clickfix_npm_delivery' npm package has no legitimate library functionality and only includes an HTML page that impersonates Cloudflare's Turnstile verification. When a victim interacts with the fake checkbox, a PowerShell one-liner is copied to the clipboard, instructing the user to execute it manually. This command downloads a malicious script from an attacker-controlled EC2 instance over HTTP and executes it, resulting in arbitrary code execution on the victim's Windows system. The package is distributed via npm, leveraging social engineering to induce execution.

Any system with this package installed or running is considered fully compromised. Attackers gain arbitrary code execution, allowing them to control the victim's machine. All secrets and keys stored on the compromised system should be considered exposed and must be rotated immediately from a secure environment. Removing the package alone may not eliminate all malicious components due to the potential for persistent backdoors.

Remove the 'clickfix_npm_delivery' package immediately from all affected systems. Rotate all secrets and keys stored on compromised machines from a different, secure computer. Because the package enables full system compromise, assume persistent infection and conduct a thorough incident response. No official patch or fix is available; remediation relies on removal and secret rotation.