The 'hxckdoeaqjlc8' npm package version 1.0.0 ships a single HTML file mimicking Cloudflare's interstitial page. Upon Turnstile widget callback, JavaScript reconstructs and redirects the browser to a phishing URL, forwarding query parameters. The package.json lacks lifecycle scripts and points 'main' to the HTML file, so no code executes during npm install or require. This artifact abuses the npm registry as static hosting for phishing, targeting browser visitors rather than developers. According to the GHSA-malware source, any system with this package installed or running should be considered fully compromised, necessitating secret/key rotation and package removal, though removal may not fully eliminate malicious presence.

The package facilitates phishing by redirecting users to a malicious site impersonating Cloudflare's interstitial page. Systems with this package installed or running are considered fully compromised, implying potential unauthorized access or control. Secrets and keys stored on affected systems may be exposed and must be rotated. Removal of the package alone may not guarantee full remediation due to possible additional malicious software installed.

No official patch or fix is available. Immediate removal of the 'hxckdoeaqjlc8' package version 1.0.0 is recommended. All secrets and keys on affected systems should be rotated from a separate, trusted device. Due to the risk of full system compromise, further forensic analysis and remediation may be necessary. Monitor for any signs of persistent malicious activity beyond the package itself.