yangming8 @1.0.0

Summary

The tarball's only shipped file is index.html, declared as the package's main . There are no lifecycle scripts, no JavaScript entry point, no dependencies, and no library surface — installing or require() -ing the package does not execute the payload on the installer's machine. The HTML presents a fake Cloudflare 'Just a moment...' verification page and, after a 1-second setTimeout, runs obfuscator.io-style JavaScript that reconstructs a destination URL from split string literals ('gin.microc' + 'loud.homes' + '/') and calls window.location.replace on it, forwarding the original query string. The destination is a lookalike domain at login.microcloud.homes (impersonating MicroCloud). The package appears to exist solely to host the phishing lander for retrieval via npm CDN mirrors (unpkg/jsdelivr), abusing the registry as static hosting for a browser-side credential-phishing page. Because the harm targets end users who load the HTML in a browser via a CDN URL — not developers who npm install this package — the installer-side risk is minimal, but the abusive distribution warrants registry takedown.

Source: amazon-inspector (c011964f9503dad45858ba2fdd5de1303275d7a0a680e2c482c3e14d90c4e33c)