The npm package 'mnhdjoweuq' version 1.0.0 contains malicious code embedded in an HTML file that mimics a Cloudflare Turnstile challenge. When the HTML is loaded in a browser, it executes an obfuscated redirect to a potentially malicious URL. The package does not execute code during installation or require, so the malicious behavior only triggers when the HTML is served and viewed in a browser. Despite this, a security source warns that any system with this package installed should be considered fully compromised, recommending immediate secret and key rotation and package removal.