The npm package 'zxhgssiyluwxchn' version 1.0.0 contains a single HTML file that renders a Cloudflare Turnstile challenge page with heavily obfuscated JavaScript. This JavaScript reconstructs a URL impersonating cloudflare.com to serve a phishing landing page. The package does not execute code on installation, but serves as static hosting for browser-side phishing via npm CDN proxies. Installing this package does not run malicious code locally, but users fetching the HTML in browsers may be targeted for phishing. The package is considered malicious and should be removed.