@flexmr/utils@10.0.12

Summary

@flexmr/utils@3.0.12 ships a one-line re-export stub whose package.json declares its sole dependency daemon-thread-lookup-buffer via a direct HTTPS URL to a non-registry host: https://artifacts.creditslib.com/npm/daemon-thread-lookup-buffer. The dependency is unpinned, carries no integrity hash, and is not resolved through the npm registry. On npm install, npm fetches whatever bytes that host returns and installs them as a package, executing any lifecycle scripts (preinstall/install/postinstall) contained in that artifact; the shipped index.js then re-exports the fetched module so require('@flexmr/utils') also loads its code. The manifest further exhibits dependency-confusion shape: the @flexmr/* scope with placeholder metadata (author Package Registry, generic description, example.com repository) suggests a package intended to shadow an internal name during resolution. Control of install-time and import-time code execution on the installer's host rests entirely with the operator of artifacts.creditslib.com.

Source: amazon-inspector (7039d72eee8d5f1abdc19889f0712d38273fd988a32aee832fc651712e386c52)