The passport811 package version 1.0.0 on npm includes a single HTML file designed to mimic a Cloudflare Turnstile 'Just a moment...' challenge. Upon the Turnstile callback, obfuscated JavaScript dynamically constructs a URL pointing to the typosquatting domain microsofte.live and redirects the browser there, forwarding query parameters. The package has no executable code during npm install or require, indicating its primary purpose is to serve as a phishing kit hosted via npm rather than a traditional software library. This behavior can lead to full system compromise if the package is installed or run.

Any system with [email protected] installed or running should be considered fully compromised. Attackers may have obtained full control over the system, potentially exposing all stored secrets and keys. Removal of the package alone does not guarantee eradication of all malicious components or backdoors introduced by the attacker.

Remove the [email protected] package immediately from all systems. Rotate all secrets and keys from a separate, trusted environment, as the system may be fully compromised. There is no official patch or fix since this is a malicious package rather than a vulnerability in legitimate software. Avoid installing packages from untrusted sources and verify package authenticity before use.