The npm package 'yangming708' version 1.0.0 contains a tarball with only a package.json and an index.html file. The package.json specifies 'index.html' as the main entry, which is not a Node.js module, and no lifecycle scripts are declared. The index.html includes an obfuscated script that, when opened in a browser, redirects to a potentially malicious URL. Installing or requiring the package in a Node.js environment does not execute this code. However, if the HTML is opened in a browser, it can lead to a redirect to a malicious site. The package appears to be registry spam or a mispublished browser-side redirect page rather than a direct supply-chain attack. Despite this, one source claims that any system with this package installed or running should be considered compromised, recommending immediate secret rotation and package removal.