The 'thundertiger' npm package version 1.0.0 ships only a single HTML file containing an obfuscated inline script. This script mimics a Cloudflare 'Just a moment...' challenge and, after a delay, redirects the browser to a constructed external hostname ('login.microcloud.homes') with the current URL's query string appended. The package.json does not include lifecycle scripts and the main entry points to the HTML file, so installing or requiring the package does not trigger the payload on the developer's machine. The malicious behavior targets end users who load the hosted HTML, effectively using the npm registry as a content delivery network for a phishing kit. This constitutes registry and namespace abuse rather than a direct code execution vulnerability on installation.

End users who load the malicious HTML content are redirected to an external phishing site, potentially exposing them to credential theft or other attacks. Systems with the package installed should be considered fully compromised, as the package may have been used to deploy additional malicious software. All secrets and keys on affected systems should be rotated from a clean environment. Removal of the package alone may not eliminate all malicious components.

Remove the 'thundertiger' package version 1.0.0 immediately if installed. Rotate all secrets and keys from a different, uncompromised system. Conduct a thorough security review of affected systems to detect and remediate any additional malware or persistence mechanisms. Coordinate with the npm registry to report and request takedown of the malicious package to prevent further abuse. Since the malicious payload is delivered via hosted HTML content, avoid loading or serving this content from untrusted sources.