The npm package 'mnchfnvbue1' version 1.0.0 is malicious. Its tarball contains only an index.html file with obfuscated JavaScript that simulates a Cloudflare 'Just a moment...' interstitial. After a 1-second timeout, it decodes a string array to build a URL and redirects the browser to that URL using window.location.replace. The package lacks npm lifecycle scripts and a JavaScript main entry, so the malicious code does not execute during installation or require(). This indicates the package is used for registry abuse to serve obfuscated browser redirects rather than a supply-chain attack targeting npm installers. Despite this, the vendor advisory states any system with this package installed or running should be considered fully compromised, with immediate secret/key rotation and removal recommended.

The package does not execute malicious code during npm install or require(), limiting direct supply-chain impact on developers. However, if the HTML is rendered in a browser, it triggers a redirect to a potentially malicious URL. The vendor advisory warns that any system with this package installed or running should be considered fully compromised, implying that the package may be part of a broader compromise or that additional malicious activity could have occurred. Secrets and keys on affected systems should be rotated immediately. Removing the package alone may not fully remediate the compromise.

Remove the 'mnchfnvbue1' package version 1.0.0 from all systems. Immediately rotate all secrets and keys stored on affected machines from a separate, trusted system. Because the vendor advisory indicates full compromise is likely, assume additional malicious software may be present and conduct a thorough investigation. There is no official patch or fix since this is registry abuse rather than a traditional vulnerability. Prevent installation of this package by auditing dependencies and using package allowlists or blocklists.