The 'yangming8' npm package version 1.0.0 contains only an index.html file declared as its main entry point. This HTML file displays a fake Cloudflare 'Just a moment...' page and, after a short delay, executes obfuscated JavaScript that reconstructs and redirects the browser to a phishing domain impersonating MicroCloud. The package lacks lifecycle scripts, JavaScript entry points, dependencies, or library code, so installing or requiring it does not execute the payload on the installer's machine. Instead, the package abuses the npm registry and CDN mirrors (such as unpkg and jsdelivr) as static hosting for a browser-side credential phishing page. The installer-side risk is minimal, but the distribution method enables phishing attacks on users who load the HTML via CDN URLs. The package should be removed from the registry to prevent abuse.

End users who load the index.html file from the 'yangming8' package via npm CDN mirrors are redirected to a phishing site designed to steal credentials by impersonating MicroCloud. Developers installing or requiring the package are not directly exposed to code execution or payload delivery. The malicious package abuses the npm ecosystem for static hosting of phishing content, potentially leading to credential theft from users. There is no evidence of active exploitation in the wild or direct system compromise from installation.

Since the malicious payload is delivered via the package's HTML file served through CDN mirrors, users and developers should avoid loading content from this package's CDN URLs. The package version 1.0.0 should be removed from the npm registry to prevent further abuse. There is no indication of code execution on installation, so removing the package from developer environments is precautionary. Rotate any credentials that may have been exposed if the phishing site was accessed. Patch status is not applicable as this is a malicious package rather than a software vulnerability with a fix.