MAL-2026-13843 Malicious code in xcnvjfsiewlk9 (npm)

The package's sole content is an index.html disguised as a Cloudflare Turnstile 'Just a moment…' verification page. The HTML contains obfuscator.io-style JavaScript (large _0x string array with _0xba1402/_0x55c229 decoder functions) that reconstructs a URL ending in 'e.club/' and manipulates window.location search parameters — a browser-side redirect lure. package.json sets main to index.html (not a Node-loadable module), declares no lifecycle scripts (preinstall/install/postinstall/prepare), and defines no bin entries. Installing or requiring the package on a developer machine does not execute the obfuscated code; the payload can only run if the HTML file is opened in a browser. The artifact is registry-abuse / phishing-content hosting on npm rather than a supply-chain attack against installers.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.