The npm package [email protected] is a malicious package that ships only an index.html file masquerading as a Cloudflare Turnstile 'Just a moment...' verification page. It contains obfuscated JavaScript that constructs a URL ending with 'loud.homes/' and redirects the browser there, propagating query parameters. The package is not a functional Node module and does not execute code during npm install; instead, it abuses npm-backed CDN mirrors to serve phishing content to end users. According to the ghsa-malware source, any system with this package installed or running should be considered fully compromised, with immediate secret/key rotation recommended.

The package's presence indicates a high risk of phishing attacks against end users via npm CDN mirrors. Although it does not execute code on the developer's machine during installation, it serves obfuscated phishing content to browsers, potentially leading to credential theft or other malicious outcomes. The ghsa-malware advisory states that any computer with this package installed or running should be considered fully compromised, implying possible backdoors or additional malware beyond the phishing page. Secrets and keys stored on the compromised system must be rotated immediately.

Remove the gdwkh6vcbu package immediately from all systems. Rotate all secrets and keys from a secure, uncompromised environment. Since the package does not execute code during installation but serves phishing content via npm CDN mirrors, avoid using untrusted or suspicious npm packages, especially those with placeholder metadata and no legitimate functionality. Monitor for any signs of compromise and consider full system forensic analysis due to the risk of full compromise. Patch status is not applicable as this is a malicious package, not a vulnerability with a fix.