MAL-2026-15497

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (fb71ca2dc9e74e42a64b1533ecb98ea1cad26e283b0c3d3ba0f4e7c760fac713) package.json declares a dependency whose key is the package's own name (`amplitude-session-replay`) and whose value is a plain HTTPS URL, `https://repo.securityctrl.com/amplitude-session-replay`, instead of a registry version range. On `npm install`, npm fetches the tarball bytes returned by that URL and installs whatever it contains, including running any lifecycle scripts inside — with no version pin, no integrity hash, and no registry vetting. The shipped source in the published tarball is an inert stub, so the manifest itself is the delivery mechanism: whoever controls repo.securityctrl.com controls code executed on the installer's machine at install time. The self-referential dependency name (dependency-confusion shape) also encourages resolvers to prefer this entry over any legitimately-named `amplitude-session-replay` package. The host is unrelated to Amplitude's own domains.