The npm package @worrisome/aaaa contains malicious code that impersonates a Cloudflare Turnstile security check page. When loaded in a browser via an npm CDN, it fetches and decrypts a destination URL and redirects the browser to a runtime-chosen URL. The package does not execute code during installation or require/import in Node.js, so the threat targets end-user browsers loading the HTML through CDNs, not developers or build systems. Computers with this package installed or running should be considered fully compromised, and all stored secrets and keys should be rotated immediately.