The mnteckets package on npm, specifically versions 1.0.0 and 1.0.1, contains a tarball with only a package.json and an index.html file. The package.json declares no lifecycle scripts and sets the main entry to index.html, which Node.js cannot execute. The index.html file mimics a Cloudflare Turnstile challenge and, upon challenge completion, uses obfuscated JavaScript to redirect the browser to a malicious URL. This redirect only triggers when the HTML file is opened in a browser, not during package installation or usage in Node.js. The package is identified as hosting phishing or redirect content rather than performing code execution during npm install, indicating it is not a supply-chain attack targeting npm installers. Despite this, one source claims that any system with this package installed should be considered fully compromised and recommends immediate secret/key rotation and package removal.

Users who open the index.html file from the mnteckets package in a browser may be redirected to a phishing site, potentially exposing them to credential theft or other social engineering attacks. The package does not execute malicious code during installation or runtime in Node.js, limiting the attack vector to manual user interaction with the HTML file. However, one source suggests that installation of this package could lead to full system compromise, though this claim is not supported by the technical details describing the package contents. There is no evidence of automated code execution or exploitation during npm install.

No official patch or fix is available for this package. Users should remove the mnteckets package versions 1.0.0 and 1.0.1 from their environments. Avoid opening the index.html file in a browser to prevent redirection to phishing sites. Rotate any secrets or keys stored on potentially affected systems as a precaution. Since the package does not execute code during installation, the primary mitigation is to avoid interacting with the malicious HTML content. Monitor npm registries for package removals or updates and consult vendor advisories if available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.