The npm package cxcbdjxcmncvfg2 version 1.0.0 includes a single index.html file that visually mimics a Cloudflare 'Just a moment...' challenge page, including spoofed elements such as a Ray ID and meta tags to avoid indexing. After a short delay, obfuscated JavaScript reconstructs a URL pointing to an attacker-controlled domain (gin.microcloud.homes) and redirects the browser there, propagating all query parameters. This domain is not affiliated with Cloudflare, and the package has no legitimate JavaScript main file, lifecycle scripts, or importable modules. Its sole purpose is to abuse the npm registry as a distribution channel for a phishing landing page. According to the source, any system with this package installed or running should be considered fully compromised, with immediate secret and key rotation recommended from a different computer.

Systems that have this package installed or running may be fully compromised, as the package facilitates phishing by redirecting users to an attacker-controlled domain. This can lead to credential theft or further compromise. The presence of this package indicates a high risk to secrets and keys stored on the affected system, necessitating immediate rotation of all such credentials from a secure environment.

Remove the malicious package immediately. Rotate all secrets and keys stored on the affected system from a separate, secure computer. Because the package may have given attackers full control over the system, removing the package alone does not guarantee complete remediation. Conduct a thorough security assessment and consider rebuilding the affected system if compromise is suspected.