The npm package 'nottuff4' version 1.7.7 contains malicious code that acts as a Scramjet-based web proxy with obfuscated JavaScript assets. When served as a website, it installs event listeners that trigger a monetized popup redirect to an external site upon user interaction. The package metadata is placeholder and suspicious, and the package does not execute malicious code during installation or import in Node.js, but only when unpacked and served to browser visitors. This behavior constitutes registry-policy abuse rather than a direct supply-chain attack on developers.