The ms_aidc_com_tw npm package (version 1.0.0) is a malicious package that hosts only an index.html page rendering a fake Cloudflare Turnstile verification. The obfuscated JavaScript collects query parameters and redirects users to login.microsoftonline.com with these parameters preserved, facilitating an adversary-in-the-middle OAuth-consent phishing attack. The package name mimics a legitimate Microsoft Taiwanese corporate domain to deceive users. This abuse of the npm registry serves as hosting infrastructure for Microsoft 365 credential harvesting. The obfuscation techniques include rotating string arrays, RC4/base64 decoding, and anti-debugging measures to conceal the phishing logic.

Any system with this package installed or running should be considered fully compromised. The attacker may gain access to Microsoft 365 credentials through OAuth-consent phishing, potentially leading to unauthorized access to sensitive accounts and data. All secrets and keys stored on the compromised system should be considered exposed and require immediate rotation. Removal of the package alone does not guarantee elimination of all malicious software or attacker persistence.

Remove the ms_aidc_com_tw package immediately if installed. Rotate all secrets, credentials, and keys stored on the affected system from a separate, trusted device. Because full compromise is likely, conduct a thorough investigation and consider rebuilding the affected system to ensure removal of any persistent malicious components. There is no official patch or fix for this package as it is a malicious artifact rather than a software vulnerability. Avoid installing packages from untrusted sources and verify package authenticity before use.