The 'xcnvjfsiewlk9' npm package version 1.0.0 contains a single index.html file that mimics a Cloudflare Turnstile 'Just a moment...' page. Embedded obfuscated JavaScript reconstructs a URL ending in 'e.club/' and manipulates browser window location parameters to redirect users to that URL. The package.json does not define lifecycle scripts or executable binaries, so installing or requiring the package does not trigger code execution. The malicious payload activates only if the HTML file is opened in a browser, making this a phishing content hosting abuse on the npm registry rather than a traditional supply-chain attack. Despite this, the ghsa-malware source warns that any system with this package installed should be considered fully compromised, recommending immediate secret rotation and package removal.

The package itself does not execute malicious code during installation or runtime in Node.js environments, limiting direct supply-chain exploitation. However, if the malicious index.html file is opened in a browser, it executes obfuscated JavaScript that redirects the user to a potentially harmful external site. The ghsa-malware advisory indicates that systems with this package installed may be fully compromised, implying that the package could be part of a broader compromise or that other malicious components may be present or installed alongside it. This poses a risk of credential theft or further system compromise if the malicious redirect is followed.

Remove the 'xcnvjfsiewlk9' package version 1.0.0 from all affected systems. Rotate all secrets and keys stored on those systems using a separate, uncompromised device. Since the package does not execute code on install or require, the main risk is from opening the HTML file in a browser; avoid opening any files from this package in browsers. There is no official patch or fix available; remediation involves removal and secret rotation. Monitor for any signs of broader compromise beyond this package.