The mobicommn npm package version 1.0.0 contains malicious code in the form of an index.html file that mimics a Cloudflare Turnstile challenge. This HTML file, when loaded in a browser, reconstructs a URL from an obfuscated string and redirects the user. The malicious code does not execute during npm install or when the package is imported in Node.js, as Node does not execute HTML files. However, if the HTML file is opened in a browser, it can trigger the redirect. The package is considered fully compromising to any system where it is installed or running, with a recommendation to rotate all secrets and keys from a different machine and remove the package. There is no confirmed patch or fix available at this time.