ratelimitsucks6 is one variant in a numerically iterated family of malicious npm packages auto-published via an infinite loop script included in the tarball. The package metadata is deceptive, with unrelated names and minimal description. The tarball contains a full Scramjet web-proxy runtime and multiple obfuscated JavaScript bundles. An index.html file masquerades as a tutoring site but loads third-party scripts and opens an external URL on first user interaction. No npm lifecycle hooks are declared, and the main script uses importScripts(), which is undefined in Node.js, so the package does not auto-execute on install or require. The primary harm is registry pollution and namespace abuse, but any system with this package installed or running should be considered fully compromised, as it may have allowed external control and data exposure.

Any computer with this package installed or running is considered fully compromised. Attackers may have gained full control, risking exposure of all secrets and keys stored on the system. The package's obfuscated payload can load external scripts and redirect users, potentially facilitating further malicious activity. Removal of the package alone does not guarantee eradication of all malicious software or backdoors introduced.

No official patch or fix is available. The package should be removed immediately from any affected systems. All secrets and keys stored on compromised computers must be rotated from a different, clean system. Due to the potential full compromise, a thorough incident response and system rebuild may be necessary. Monitor for and block related package names to prevent accidental installation. Avoid installing packages with suspicious or auto-generated names and verify package authenticity before use.