The npm package 'dzcvhfruwluwe' (versions 1.0.0 and 1.0.1) contains a single file, index.html, which displays a fake 'Cloudflare Verifying...' page. This page includes an obfuscated script that reconstructs a URL to an attacker-controlled domain and redirects the browser to that domain after a 1-second timeout using window.location.replace. The package.json does not define lifecycle scripts and points the main entry to the HTML file, so the malicious payload does not execute during npm install or require(). The threat is limited to browser-side redirection for users who load the HTML file, representing registry abuse for phishing or malvertising purposes rather than a supply-chain compromise of the developer environment. The advisory from ghsa-malware warns that any computer with this package installed or running should be considered fully compromised, recommending immediate secret/key rotation and package removal, though removal may not eliminate all malicious software.

End users who load the malicious index.html file in a browser are redirected to an attacker-controlled domain, potentially exposing them to phishing or malvertising content. The package does not execute malicious code during installation or runtime in the developer environment, so the direct impact on developers is limited. However, the ghsa-malware advisory states that any computer with this package installed or running should be considered fully compromised, implying that the package may be part of a broader compromise or that additional malicious components may be present. Secrets and keys on affected machines should be rotated immediately. There is no evidence of active exploitation in the wild.

Remove the 'dzcvhfruwluwe' package from all affected systems. Immediately rotate all secrets and keys stored on any computer where this package was installed or running, using a different, uncompromised machine. Since the malicious payload is browser-side and the package does not execute during installation, ensure users do not open the index.html file from this package. Monitor for any further signs of compromise as removal of the package alone may not eliminate all malicious software. Patch status is not yet confirmed — check vendor advisories for any updates or official fixes.