thundertiger @1.0.0

Summary

The package's only shipped content is a single HTML file that mimics a Cloudflare 'Just a moment...' security challenge. The inline script is obfuscated with an obfuscator.io-style shuffled string-array + hex identifier decoder and anti-debug console overrides. After a 1-second delay it assembles a hostname from split literals ('gin.microc' + 'loud.homes' → login.microcloud.homes), forwards the current URL's query string, and calls window.location.replace to redirect the browser to that external host. package.json declares no lifecycle scripts and main points at HTML rather than a loadable JS module, so installing or requiring the package does not directly execute the payload against a developer's machine — the harm is directed at end users who load the hosted HTML, using the npm registry as a CDN for a phishing kit. This is registry/namespace abuse rather than a direct installer-side attack; recommend human review to confirm and to coordinate takedown with the registry.

Source: amazon-inspector (b1c287b2a6653cf3abb51d22059dbe433959b3a2445a75f32e27ed029b1e42d7)