The npm package 'clxofwfjskaz7' version 1.0.0 includes a tarball with only a package.json and an index.html file. The package.json specifies 'index.html' as the main entry point but does not include any lifecycle scripts, so no code executes during installation or module loading in Node.js. The index.html file displays a fake Cloudflare 'Just a moment...' interstitial page and, upon a Turnstile callback, runs obfuscated JavaScript that constructs a URL and redirects the browser via window.location.assign. This malicious payload targets browsers accessing the package through npm-backed CDNs like unpkg, not developers installing the package. The package is considered fully compromising to any system where it is installed or running, necessitating immediate secret rotation and removal.

Any computer with this package installed or running should be considered fully compromised. Attackers may have gained full control over the system, potentially exposing all stored secrets and keys. Simply removing the package does not guarantee removal of all malicious artifacts or backdoors introduced by the package. The threat primarily affects environments where the package's HTML is loaded in browsers via npm-backed CDNs, enabling redirection to potentially malicious sites.

No official patch or fix is available. Immediate removal of the 'clxofwfjskaz7' package version 1.0.0 is recommended. All secrets and keys stored on affected systems should be rotated from a separate, uncompromised device. Due to the potential full system compromise, further forensic analysis and remediation may be necessary beyond package removal.