The npm package 'bgncvhferucfds' contains a single obfuscated HTML file that, when loaded in a browser, displays a fake Cloudflare Turnstile verification screen and redirects users to a phishing page impersonating Microsoft login. The package does not execute code during installation or require, so developers installing it are not directly attacked. Instead, it abuses the npm registry and public CDN mirrors as free hosting for a Microsoft credential phishing lure. Computers with this package installed or running should be considered fully compromised, and all stored secrets and keys should be rotated immediately.