The 'mnhdjoweuq' npm package version 1.0.0 contains only a package.json and an index.html file. The main entry points to the HTML file, which mimics a Cloudflare Turnstile 'Just a moment' challenge. The HTML contains obfuscated JavaScript that reconstructs a URL starting with 'https://lo' and redirects the browser to it. No lifecycle scripts are present, so no code executes during npm install or require. The malicious redirect triggers only when the HTML is loaded in a browser, such as when served via a CDN like unpkg or jsdelivr. A security advisory states that any computer with this package installed or running should be considered fully compromised, recommending secret/key rotation and removal of the package, though removal may not eliminate all malicious software.

The malicious code causes a browser redirect to a potentially harmful URL when the HTML file is loaded, which could lead to further compromise of browser sessions or user data. Additionally, a security source warns that the presence of this package indicates full system compromise, implying that attackers may have gained control over the affected computer and that secrets and keys stored on it are at risk. This suggests a high impact on confidentiality and system integrity.

No official patch or fix is available. The package should be removed immediately from any affected systems. All secrets and keys stored on the compromised computer should be rotated immediately from a different, trusted machine. Due to the potential full system compromise, further forensic analysis and remediation may be necessary. Since the malicious behavior only triggers when the HTML is loaded in a browser, avoid serving or loading the package's HTML content in browsers. Patch status is not yet confirmed — check the vendor advisory or security sources for updates.