MAL-2026-15514

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (5ebda78171ac8816c0e350f84923af0bad54c075f91cfcc1a7bcc26d36674c4f) package.json line 11 declares the package's own name 'mintel-taskbar' as a dependency whose source is the bare HTTPS URL https://repo.securityctrl.com/mintel-taskbar, not a registry version range. On `npm install`, npm resolves this dependency by fetching whatever tarball that URL returns and installs it — running any lifecycle scripts inside the fetched tarball — with no version pin and no integrity check. Whoever controls repo.securityctrl.com therefore controls code executed on every installer's machine. The self-referential shape (dependency key equals the package's own name) combined with an implausibly high version (45.0.0) is consistent with a dependency-confusion lure that resolves against an internal package of the same name.