The npm package 'egair0810' versions 1.0.0 and 1.0.1 contains malicious code in the form of a single HTML file that displays a fake Cloudflare Turnstile page with obfuscated JavaScript. This code executes only when the HTML file is opened in a browser, redirecting users to a target URL. The package does not execute this code during npm install or require(), indicating it is not a typical supply-chain attack targeting developers but rather a registry abuse hosting a browser-facing phishing lure. Installing or running this package may lead to full system compromise.