The npm package vfgnhlkxchrd versions 1.0.0 and 1.0.1 includes a single HTML file as its main entry point, which contains obfuscated JavaScript that reconstructs and redirects to the URL https://config.microsofte.live/, a typosquatted domain mimicking Microsoft services. The malicious redirect triggers only when the HTML file is loaded in a browser environment, such as through npm CDNs like unpkg or jsdelivr, not during standard Node.js package installation or usage. This package is leveraged as a phishing hosting mechanism rather than a legitimate Node module. According to the GHSA malware advisory, any computer with this package installed or running is considered fully compromised, necessitating immediate rotation of all secrets and keys from a separate, trusted system. The advisory warns that removing the package alone may not remove all malicious software resulting from its installation.

Systems with the vfgnhlkxchrd package installed or running are considered fully compromised, potentially allowing attackers full control. All secrets and keys stored on such systems may be exposed and must be rotated immediately. The malicious payload redirects users to a phishing domain, facilitating credential theft or other phishing attacks. Because the package acts as a hosting vector for phishing infrastructure, it poses a significant risk to users who access the malicious HTML file via npm CDNs. Removal of the package does not guarantee elimination of all malicious components due to possible further compromise.

Immediate removal of the vfgnhlkxchrd package versions 1.0.0 and 1.0.1 is recommended. All secrets, keys, and credentials stored on affected systems should be rotated immediately from a separate, trusted machine. Due to the high likelihood of full system compromise, a thorough security assessment and potential system rebuild may be necessary. There is no official patch or fix for this malicious package, as it is not a software vulnerability but a malicious artifact. Users should avoid loading the package's HTML file in browsers, especially via npm CDNs. Monitor for any suspicious activity related to this package and related domains.