The npm package 'hcfguyfrmblp' version 1.0.0 contains a tarball with only a package.json and an index.html file. The index.html mimics a Cloudflare Turnstile verification page and runs obfuscated JavaScript that reconstructs a destination URL and redirects the browser to it, forwarding all query parameters. Since npm does not auto-execute HTML files on install or require, the malicious code does not run on the developer's machine but targets browsers visiting sites serving this HTML. The package is abused as a hosting or staging channel for browser-side phishing or redirect lures rather than a supply-chain attack against npm installers. According to a malware source, any computer with this package installed or running should be considered fully compromised, requiring immediate secret and key rotation and package removal, though removal may not fully eliminate the compromise.

The impact is primarily on browsers that load the malicious HTML page served by this package, which redirects users to potentially harmful destinations. Although the malicious code does not execute during npm install or require, the presence of this package on a system indicates a full compromise, potentially allowing attackers full control over the affected computer. All secrets and keys stored on compromised systems should be rotated immediately. Removing the package alone may not fully remove all malicious software resulting from the compromise.

No official patch or fix is indicated. The package should be removed immediately from any system where it is installed. All secrets and keys stored on the affected computer should be rotated from a separate, trusted machine. Because the compromise may be extensive, additional forensic investigation and remediation may be necessary. There is no indication that npm or the vendor has issued an official fix or advisory; patch status is not yet confirmed — check the vendor advisory for current remediation guidance.