The npm package passport811@1.0.0 contains a malicious HTML file that impersonates a Cloudflare Turnstile challenge. When triggered, it redirects users to a Microsoft typosquatting domain (microsofte.live) via obfuscated JavaScript. The package does not execute code during installation or require calls and serves as a hosted phishing kit distributed through the npm registry. Installation or use of this package may lead to full compromise of the affected system.