The npm package 'bcnfjndwbkf2' version 1.0.0 contains malicious code that serves an obfuscated HTML redirect page mimicking a Cloudflare interstitial. This package does not execute code during installation or runtime in Node.js environments but redirects browser visitors who access the package via npm CDN mirrors to a potentially malicious URL. Although it does not represent a traditional supply-chain attack via npm install, the package abuses npm as a static host for browser-side redirection. One source claims that any system with this package installed or running should be considered fully compromised, recommending immediate secret rotation and package removal.