Twenty-four purpose-built npm packages ship a single HTML file as their package payload rather than any JavaScript, and are published solely so that CDN mirrors of the registry serve the file as a fake browser-verification page from a trusted domain. Installing the packages executes nothing; the malicious behavior is the hosted page, which walks the visitor through pasting an attacker-supplied command into their own shell.