The npm package cxcbdjxcmncvfg2 version 1.0.0 contains malicious code that impersonates a Cloudflare challenge page to redirect users to an attacker-controlled domain. The package is designed solely to serve a browser-side phishing landing page and does not include any legitimate JavaScript modules or lifecycle scripts. Installation or execution of this package may lead to full compromise of the affected system, requiring immediate secret and key rotation from a separate device.