MAL-2026-13797 Malicious code in cvbniydplwe3 (npm)

The tarball contains only index.html (declared as package.json main) and no JavaScript, no lifecycle scripts, and no Node-executable entry point. index.html renders a fake 'Just a moment…' Cloudflare Turnstile interstitial; on the Turnstile callback, an obfuscated string-array deobfuscator reconstructs a target URL and assigns it to window.location. HTML cannot be require()'d and there are no preinstall/install/postinstall hooks, so npm install and require('cvbniydplwe3') do not execute this code on the installer's machine. The behavior is a browser-side redirect that would only fire if the HTML were served from a CDN and loaded in a browser. This appears to be npm-registry abuse — parking phishing/redirect content in a package slot — rather than a supply-chain attack against installers.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.