The speed2 package on npm is a typosquatting malicious package that does not function as a Node.js module but instead bundles a browser-based malicious web proxy and obfuscated JavaScript assets. The package.json points to a ServiceWorker script intended for browsers, not Node.js, preventing direct code execution during installation or import in Node. However, the package includes scripts and nested directories evidencing automated mass-publishing of similarly named typosquat packages (speed1 to speed5). The obfuscated browser assets and popunder behavior suggest a malicious campaign designed to lure users into visiting a malicious site. According to a ghsa-malware source, any system with this package installed or running should be considered fully compromised, requiring immediate secret/key rotation and package removal.

Installation or execution of this package can lead to full system compromise. Secrets and keys stored on the affected system may be exposed and must be rotated immediately. The malicious code is obfuscated and bundled for browser execution, but the overall package is part of a typosquatting campaign that can deceive users into installing it, potentially leading to unauthorized access and control over the affected computer.

No official patch or fix is available as this is a malicious package rather than a software vulnerability. The recommended mitigation is to immediately remove the speed2 package and any related typosquat packages (speed1 through speed5) from the system. Rotate all secrets and keys from a secure, unaffected environment. Conduct a thorough system audit for other signs of compromise. Namespace abuse and takedown requests should be pursued through npm and relevant authorities to remove these malicious packages from the registry.