The sixseven3 npm package includes a browser ServiceWorker script and multiple heavily obfuscated JavaScript bundles that implement a 'web unblocker' proxy site injecting popunder ads. The package does not execute code upon installation in Node.js environments due to reliance on browser-specific globals, so developers installing it face limited risk. The package is part of a name-squatting campaign involving multiple similarly named packages. Despite limited execution risk during installation, a malware advisory states that any computer with this package installed or running should be considered fully compromised, recommending immediate secret/key rotation and removal of the package, though removal may not fully clean the system.

Installing the package in a Node.js environment does not trigger code execution, limiting risk to disk usage and npm registry pollution. However, if the package's code is deployed in a browser context, it can proxy cross-origin fetches and inject unwanted advertisements, potentially impacting end users. The malware advisory indicates that the package may lead to full system compromise, requiring secret and key rotation and thorough cleanup. This suggests the package may contain or facilitate malicious payloads beyond the described proxy functionality.

No official patch or fix is indicated. The package should be removed immediately if installed. All secrets and keys on affected systems should be rotated from a different, trusted machine. Due to potential full system compromise, comprehensive incident response and system cleanup are recommended. Developers should avoid installing or using this package and related name-squatting packages. Registry maintainers should consider removing these packages to prevent further distribution.