The 'ishowfeet14' npm package contains a script 'auto-publish.sh' that automates republishing the same payload under approximately 100 different npm package names by modifying 'package.json.name' and running 'npm publish' in a loop, constituting namespace spam. Its declared main entry is a browser Service Worker script that loads obfuscated web proxy assets themed as 'Riverbend Tutoring' and triggers a popunder redirect to 'https://abdct.com/'. The package does not execute code during Node.js installation, preventing installer-side compromise, but any system running or installing the package is considered fully compromised due to the malicious browser-side payload. The package abuse is primarily registry namespace spam and browser-based malicious redirection.

Installing or running this package can lead to full system compromise, as indicated by the source advisory. All secrets and keys on the affected computer should be considered compromised and rotated immediately. The primary harm is registry namespace abuse and browser-side malicious proxy and redirect behavior. Node.js environments do not experience auto-execution during installation, but the browser assets serve malicious content when loaded. The package poses a critical risk to affected systems.

No official patch or fix is indicated. The package should be removed immediately from any affected systems. All secrets and keys stored on compromised computers must be rotated from a different, clean system. Since the package grants potential full control to an attacker, removal alone may not fully remediate the compromise. Namespace abuse is being routed for human review. Users should avoid installing or running this package or any similarly named variants.