The npm package 'cvmbxcjiasdg' versions 1.0.0 and 1.0.1 contains malicious code that serves a fake Cloudflare Turnstile challenge via an index.html file. This HTML page uses obfuscated JavaScript to redirect users' browsers to a constructed URL, forwarding query parameters. The package does not execute code during npm install or require, indicating it is designed to abuse the npm registry as a static host for phishing or redirect lures rather than directly attacking developers. Any system running this package should be considered fully compromised, with immediate secret and key rotation recommended.