The npm package 'xcnvjfsiewlk9' version 1.0.0 contains a malicious HTML file disguised as a Cloudflare Turnstile verification page. This HTML includes obfuscated JavaScript that redirects browsers to a potentially malicious URL. The package does not execute code upon installation or require and only triggers the payload if the HTML file is opened in a browser. This is a case of registry abuse hosting phishing content rather than a direct supply-chain code execution attack. The package should be removed, and any secrets on affected machines rotated due to potential compromise.