The npm package 'fghvbmniwu' versions 1.0.0 and 1.0.1 contains malicious code that serves a heavily obfuscated HTML page embedding a Cloudflare-branded Turnstile widget. This page redirects browsers to a constructed URL at runtime, indicating abuse of the npm registry as a free CDN for phishing or redirect landing pages. The malicious behavior only affects browsers loading the file via CDN mirrors and does not execute code during package installation or require/import in Node.js environments. Despite this, a security source warns that any system with this package installed or running should be considered fully compromised, recommending immediate secret/key rotation and package removal, though removal may not fully eliminate the threat. No official patch or fix is documented.