The 'hngfykuvgh4' npm package (version 1.0.0) contains a single index.html file declared as the main entry, which impersonates a Cloudflare 'Just a moment…' verification page embedding a real Turnstile widget and an obfuscated script. The script triggers on any Turnstile callback event to assemble a scrambled destination URL, appends the visitor's query parameters, and redirects the browser via window.location.replace(). There are no lifecycle scripts or JavaScript entry points, so no code executes during installation or import by developers. This package abuses the npm registry as static hosting for a phishing or redirect lure. According to the GHSA-malware source, any system with this package installed should be considered fully compromised, with immediate secret/key rotation recommended. Removal of the package alone may not eliminate all malicious components.

The package acts as a phishing or redirect lure by impersonating a trusted Cloudflare page and redirecting visitors to an obfuscated destination URL. Although it does not execute code during installation or import, its presence on a system indicates potential full compromise, as it may have been used to deliver or facilitate further malicious activity. Secrets and keys stored on affected systems are at risk and should be rotated immediately. The package abuse does not represent a direct supply-chain attack on developers but poses a significant risk to end users and systems where it is installed.

Remove the 'hngfykuvgh4' package immediately from any affected systems. Rotate all secrets and keys stored on compromised computers from a separate, trusted system. Since the package does not execute code during installation or import, focus on cleaning any additional malware or backdoors that may have been installed as a result of this package. Monitor for any suspicious redirects or phishing activity related to this package. There is no official patch or fix, as this is a malicious package abuse case; remediation relies on removal and secret rotation.