The npm package hgdvfuflnb@1.0.0 contains a malicious HTML file that impersonates a Cloudflare Turnstile challenge page and redirects users to a target URL via obfuscated JavaScript. The package does not execute code during installation or import, so installer-side impact is nil. However, the package abuses the npm registry as anonymous static hosting for phishing or redirector content aimed at end users who load the HTML through public npm CDN mirrors. There is no official patch or remediation guidance provided.