yangming708 (npm) · Malicious Code
Affects yangming708Source GCVE Database
Malicious package : remove yangming708 and rotate any secrets on hosts that installed it.
Data as of 12 Aug 2026, 16:37 UTC
Malicious package
Published to npm · OSV MAL-2026-13845
What to do
Remove yangming708 from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmyangming708 | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package 'yangming708' version 1.0.0 contains a tarball with only a package.json and an index.html file. The package.json specifies 'index.html' as the main entry, which is not a Node.js module, and no lifecycle scripts are declared. The index.html includes an obfuscated script that, when opened in a browser, redirects to a potentially malicious URL. Installing or requiring the package in a Node.js environment does not execute this code. However, if the HTML is opened in a browser, it can lead to a redirect to a malicious site. The package appears to be registry spam or a mispublished browser-side redirect page rather than a direct supply-chain attack. Despite this, one source claims that any system with this package installed or running should be considered compromised, recommending immediate secret rotation and package removal.