The 'cvmbxcjiasdg' npm package contains a single index.html file declared as the main entry point, with no JavaScript entry point or lifecycle scripts. The HTML mimics a Cloudflare 'Just a moment...' Turnstile challenge and embeds obfuscated JavaScript that decodes a base64 string array to construct a URL. It forwards the current page's query parameters to this URL and redirects the browser using window.location.replace. The redirect only triggers in a browser rendering index.html; npm install and require do not execute any code or installer scripts. This behavior indicates the package is used as a static host for phishing or redirect lures rather than a direct attack vector on developers. According to the GHSA-malware source, any computer with this package installed or running should be considered fully compromised, requiring immediate rotation of all secrets and keys from a different machine.

The package's malicious payload executes only in a browser rendering the index.html file, redirecting users to potentially malicious URLs with forwarded query parameters. Although npm install and require do not trigger code execution, the presence of this package on a system indicates a high risk of compromise. The GHSA-malware advisory states that any computer with this package installed or running should be considered fully compromised, implying potential unauthorized access or control. Secrets and keys stored on the compromised system should be rotated immediately. Removing the package alone may not eliminate all malicious software resulting from its installation.

No official patch or fix is available. The package should be removed immediately from any affected systems. All secrets and keys stored on the compromised computer must be rotated immediately from a separate, trusted machine. Because the package does not execute code during npm install or require, the primary risk is from browser-based redirection when rendering the index.html file. Users and administrators should avoid using or installing this package. Monitor for any signs of compromise and consider a full system audit due to the high risk of full system compromise.