The mobicommn npm package version 1.0.0 contains a malicious artifact: an index.html file that simulates a Cloudflare Turnstile challenge. Upon the Turnstile callback, it reconstructs a destination URL from a rotated obfuscated string array and performs a browser redirect via window.location.replace. Since Node.js does not execute HTML on require, this malicious redirect does not trigger during npm install or package import. The malicious payload is only activated if the HTML file is loaded in a browser, which is not a typical usage path for an npm dependency. The package is flagged as fully compromising any system where it is installed or running, with a recommendation to rotate all secrets and keys from a separate machine and remove the package. No official patch or remediation is documented.

Any computer with the mobicommn package version 1.0.0 installed or running should be considered fully compromised. The malicious code can lead to unauthorized control or data exposure. All secrets and keys stored on the compromised machine should be rotated immediately from a different, trusted machine. Removing the package alone may not eliminate all malicious software or backdoors introduced by the package installation.

No official patch or fix is currently available. Immediate removal of the mobicommn package version 1.0.0 is recommended. All secrets and keys on the affected system should be rotated from a separate, uncompromised machine. Due to the potential full compromise, consider rebuilding or thoroughly cleaning the affected system. Monitor for any unusual activity that may indicate persistent malicious presence.