The npm package 'mnchfnvbue1' version 1.0.0 contains a tarball with a single HTML file that includes heavily obfuscated JavaScript. This script mimics a Cloudflare interstitial page and redirects browsers to a constructed URL after a short delay. The malicious code does not execute during npm install or require() because the main entry is a non-JavaScript file and no lifecycle scripts are present. This behavior indicates registry abuse to host a browser redirect rather than a direct supply-chain attack on installers. However, the presence of this package on a system is considered a full compromise, requiring immediate secret and key rotation and package removal.