The npm package 'nihzvdeowx5' version 1.0.0 contains malicious code disguised as an HTML file that impersonates a Cloudflare Turnstile challenge page. It includes obfuscated JavaScript that redirects browsers to a phishing URL. The package does not execute this code during installation or when required in Node.js, indicating the attack targets browsers loading the package from a CDN rather than developers. Any system with this package installed should be considered fully compromised, and all secrets should be rotated immediately.