The 'nottuff15' npm package (version 1.7.7) is malicious software distributed as part of a namespace-spam campaign involving nearly 95 similarly named packages. The package includes a bundled SPA and ServiceWorker that acts as a web proxy, along with a 5.4MB WASM-curl bundle. Its main entry point (sw.js) uses browser ServiceWorker APIs not available in Node.js, causing errors if required as a library. The package redirects user interactions to an affiliate site and loads obfuscated remote scripts. There are no install-time scripts, so no automatic execution occurs during installation. However, any system with this package installed or running should be considered fully compromised, requiring secret and key rotation from a clean environment.

Installation or execution of this package can lead to full system compromise. The package enables browser-based redirects to potentially malicious affiliate sites and loads obfuscated scripts, which may facilitate further malicious activity. Because the package is part of a broader namespace-spam campaign, it abuses npm as a CDN for hosting malicious static assets. Secrets and keys stored on compromised systems should be considered exposed and rotated immediately.

There is no official patch or fix available. The package should be removed immediately from any affected system. All secrets and keys stored on compromised systems must be rotated from a separate, trusted environment. Since full system compromise is possible, further forensic investigation and remediation may be necessary. Monitor for and block access to the known malicious domains (e.g., abdct.com, cdn.21baseballacademy.com).