The npm package 'unitel4' version 1.0.0 contains malicious code in the form of an HTML file that impersonates a Cloudflare interstitial page. When served to an end-user browser, it executes obfuscated JavaScript that redirects the user to a suspicious '.club' domain, indicating registry abuse for phishing or cloaking purposes. The malicious payload does not execute in Node.js environments during installation or runtime, so it is not a direct supply-chain attack on developers. However, any system running this package should be considered fully compromised due to potential backdoors or additional malware. Immediate removal and secret/key rotation are recommended.