The npm package 'nottuff15' version 1.7.7 is part of a coordinated namespace-spam campaign distributing malicious code. It contains a bundled single-page application and a ServiceWorker web-proxy with a large WASM-curl bundle, intended to be hosted as a static site but abused via npm as a static-asset CDN. The package's main script triggers browser redirects to an affiliate site and loads heavily obfuscated JavaScript. It does not execute code during installation but running or installing it can lead to full system compromise. Immediate removal and secret/key rotation are advised.