The 'xhjckswqivb' npm package version 1.0.0 contains only an index.html and package.json. The HTML mimics a Cloudflare Turnstile challenge and, when loaded in a browser, constructs an obfuscated URL from fragments and redirects the visitor to https://login.microlive.club/ with the original query string appended. There are no lifecycle scripts in package.json, so npm install and require do not execute the malicious code. The threat targets end-users who open the HTML, not developers installing the package. According to the GHSA-malware source, any computer with this package installed or running should be considered fully compromised, and all secrets and keys should be rotated immediately from a different machine.

Any computer that has this package installed or running is considered fully compromised. The malicious HTML can redirect users to a potentially harmful site, which may lead to credential theft or further compromise. All secrets and keys stored on the affected machine should be rotated immediately from a secure environment. Removing the package alone may not eliminate all malicious software or backdoors introduced by this package.

No official patch or fix is available. Immediate removal of the 'xhjckswqivb' package version 1.0.0 is recommended. All secrets and keys stored on the affected computer should be rotated from a different, secure machine. Due to the potential full compromise, a thorough security assessment and remediation of the affected system are advised.