The 'unitel4' npm package version 1.0.0 contains only a package.json and an index.html file. The main entry points to the HTML file, which mimics a Cloudflare 'Just a moment...' interstitial page. The embedded Turnstile callback runs obfuscated JavaScript that constructs a URL ending with a '.club' domain, appends the current query string, and redirects the browser via window.location.replace. There are no lifecycle scripts that execute during installation or require/import, so the malicious redirect only triggers when the HTML is served and rendered by an end-user browser. This indicates the package is abused to host phishing or cloaking landing pages rather than to compromise developers through the supply chain. Despite this, the GHSA-malware source warns that any computer with this package installed or running should be considered fully compromised, recommending immediate secret/key rotation and package removal.

The malicious HTML payload causes end-user browsers to be redirected to potentially harmful phishing or cloaking domains, posing a risk to users interacting with the package's served content. Although the package does not execute malicious code in Node.js environments, the presence of this package on a system indicates possible full compromise, as attackers may have used it as a foothold to deploy additional malware or backdoors. Therefore, all secrets and keys on affected systems should be rotated immediately. The package's presence undermines trust and may facilitate phishing campaigns or other malicious activities targeting end users.

Remove the 'unitel4' package version 1.0.0 from all systems. Immediately rotate all secrets and keys stored on affected computers from a separate, trusted device. Since the package's malicious payload triggers only when the HTML is served to browsers, ensure that any web servers or services serving this content are cleaned and secured. There is no official patch or fix for this package; remediation involves removal and secret rotation. Monitor for any signs of further compromise or persistence mechanisms installed alongside this package.