The npm package 'hxckdoeaqjlc8' version 1.0.0 contains a malicious HTML file that impersonates Cloudflare's 'Just a moment...' interstitial page. When the Turnstile widget callback triggers, embedded JavaScript redirects visitors to a phishing site 'https://checkout.microlive.club/', forwarding any query parameters. The package does not execute code on install or require, indicating it is designed to serve as a phishing landing page via npm's static hosting. Installing or running this package may lead to full system compromise, requiring immediate secret and key rotation and package removal.