The npm package 'hlksdcixycvf' version 1.0.0 contains a single HTML file acting as a Cloudflare Turnstile-themed verification page with obfuscated JavaScript that redirects users upon completion of a CAPTCHA. This package does not execute code during installation or import, as npm cannot require an HTML main file, so it does not pose a direct supply-chain threat to developers. However, the package is abused as a static hosting mechanism for an obfuscated redirector likely used for phishing. Any system running this package should be considered compromised, and secrets should be rotated immediately.