The 'egypt0811' npm package version 1.0.0 contains only an index.html file with no JavaScript modules or install scripts. The HTML includes obfuscated inline JavaScript that reconstructs a URL starting with 'https://eg' and redirects the browser to that URL, forwarding query parameters. This redirect only triggers if the HTML file is opened directly in a browser. The package does not execute code during npm install or require(), indicating it is used for registry abuse to host a phishing or redirect page rather than a direct developer-targeted supply-chain attack. According to the GHSA malware advisory, any computer with this package installed should be considered fully compromised, requiring immediate secret and key rotation and package removal, though removal may not fully eliminate malicious presence.

The presence of this package on a system indicates a full compromise, as stated by the GHSA malware advisory. The package itself does not execute code during installation or runtime in Node.js environments, but the included HTML file can redirect browsers to potentially malicious phishing sites if opened directly. This can lead to credential theft or further compromise. The advisory warns that all secrets and keys on affected systems should be rotated immediately, as the attacker may have gained full control. Removing the package alone may not remove all malicious software resulting from the compromise.

Remove the 'egypt0811' package version 1.0.0 from all affected systems. Immediately rotate all secrets and keys from a different, trusted computer to prevent further unauthorized access. Because the package indicates a full system compromise, conduct a thorough investigation and remediation of the affected environment. There is no indication of an official patch or fix for this package, as it is a malicious package abuse rather than a software vulnerability. Monitor for any suspicious activity related to this package and avoid opening the index.html file in a browser.