The npm package 'thundertiger' version 1.0.0 contains malicious code in a single HTML file that mimics a Cloudflare security challenge. The embedded obfuscated script redirects users to an external phishing site. Installing or requiring the package does not execute the payload on the developer's machine, but end users loading the hosted HTML are targeted. This is an abuse of the npm registry as a CDN for phishing rather than a direct installer-side attack. The package should be removed and secrets rotated if installed, as the system may be fully compromised.