The npm package [email protected] is identified as malicious. It has a random name and lacks typical metadata such as description, author, repository, dependencies, or lifecycle scripts. Its main file is an HTML page that mimics the Cloudflare Turnstile 'Just a moment...' challenge using a real sitekey but a fake Ray ID. The embedded JavaScript is heavily obfuscated and includes anti-debugging techniques. Upon the Turnstile callback, it constructs a URL on a '.cloud.homes' domain, forwarding the current page's query parameters, and redirects the browser to that URL. This package is not intended for npm consumers but rather abuses npm's registry and CDN to host phishing content. Any system with this package installed or running should be considered fully compromised.

End users who access the package's CDN URL are redirected to a malicious domain, potentially exposing them to phishing attacks. Systems that have this package installed or running may be fully compromised, risking exposure of all stored secrets and keys. The malicious code can lead to unauthorized control over the affected computer, and simply removing the package may not eliminate all malicious artifacts.

Remove the nhdxzthponv5 package immediately from any system. Rotate all secrets and keys stored on affected computers from a secure, uncompromised device. Because the package may have granted full control to an attacker, assume full compromise and perform thorough incident response and system remediation. There is no official patch or fix since this is a malicious package rather than a vulnerability in legitimate software.