The npm package web-vitals-polyfill-core-v1 version 1.0.0 is a malicious package masquerading as a legitimate web-vitals polyfill. It contains obfuscated code designed to hijack end-user navigation by loading a service worker that redirects users to attacker-controlled destinations resolved dynamically via DNS-over-HTTPS and fallback paste sites. The package lacks any legitimate library code and is intended to compromise any system where it is installed. Systems with this package installed should be considered fully compromised.