The 'egair0810' npm package versions 1.0.0 and 1.0.1 include a malicious payload embedded in an index.html file declared as the package main entry point. This file contains heavily obfuscated JavaScript that constructs a target URL and redirects the browser via window.location.replace. The package.json lacks lifecycle scripts that would execute code during npm install or require(), so the malicious code does not run in typical Node.js environments. Instead, the payload activates only if the HTML file is opened in a browser, indicating the package is used for registry abuse to host a phishing redirect rather than a developer-targeted supply-chain attack. According to one source, any system with this package installed or running should be considered fully compromised, requiring immediate secret and key rotation and package removal.

Systems that have installed or are running the 'egair0810' package may be fully compromised, as the malicious payload can redirect users to potentially harmful URLs when the HTML file is opened in a browser. This could lead to phishing or further malicious activity. The compromise may allow attackers to gain control over the affected system, necessitating immediate rotation of all secrets and keys stored on the system. Removing the package alone may not fully remediate the compromise due to potential persistence of other malicious software.

Remove the 'egair0810' package immediately from all affected systems. Rotate all secrets and keys stored on compromised machines from a separate, trusted device. Because the package may have led to full system compromise, further forensic analysis and remediation may be required to ensure no additional malware remains. There is no indication of an official patch or fix for this package; the best mitigation is removal and secret rotation.