The [email protected] npm package is identified as malicious, belonging to a self-cloning namespace-squatting family. It includes an auto-publish.sh script that replicates the package under five similar names by modifying package.json and publishing clones. The tarball contains nested directories confirming multiple replications. The package metadata is generic and suspicious. The main payload is a deceptive HTML page that registers event handlers to open a third-party URL in a new browser tab. Additionally, the package bundles multiple heavily obfuscated JavaScript files duplicated across clones. Installing or pulling this package delivers an attacker-controlled payload that can compromise the host system.

Any system with [email protected] installed should be considered fully compromised. The malicious package can execute deceptive content and potentially allow attackers to control the affected system. Secrets and keys stored on the compromised system are at risk and should be rotated immediately. Removal of the package does not guarantee full remediation due to possible persistence of other malicious components.

Remove the [email protected] package immediately from all affected systems. Rotate all secrets and keys that were stored or accessible on the compromised system using a separate, trusted device. Conduct a thorough investigation for additional malware or persistence mechanisms, as removing the package alone may not fully restore system integrity. Monitor for any suspicious activity related to the package or its clones. Patch status is not applicable as this is a malicious package, not a vulnerability with a vendor fix.