The 'nottuff4' npm package (version 1.7.7) includes a heavily obfuscated Scramjet-based web proxy and a static cover page that installs event listeners to open a monetized popup redirect on first user interaction. The malicious payload activates only when the package is unpacked and served as a website, not during npm install or require calls in Node.js. The package is part of a set of throwaway sibling packages with placeholder metadata and suspicious naming. The main script uses service-worker globals and imports obfuscated scripts. The malicious behavior includes namespace pollution, Terms of Service-evading proxying, and monetized redirects. The threat is classified as registry-policy abuse rather than a direct supply-chain compromise of developers.

If the package is installed and then served as a website, visitors to that site will be subjected to monetized popup redirects, potentially leading to unwanted or harmful content. The package does not execute malicious code during installation or import in Node.js, so developers installing it are not directly compromised by code execution. However, any computer running this package in a serving context may be considered compromised, with potential exposure of secrets and keys. The malicious code could lead to unauthorized control over the browsing experience of website visitors.

There is no official patch or fix available for this malicious package. The recommended action is to remove the 'nottuff4' package version 1.7.7 immediately from any environment. Since the package does not execute malicious code during installation but only when served as a website, avoid serving this package's contents in a web server context. Rotate all secrets and keys from a different, trusted computer if this package was ever run in a serving environment, as full compromise is possible. Monitor for and block any related throwaway sibling packages from the same author or with similar suspicious characteristics.