MAL-2026-15518

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (e4b49e2f4d16837b49ca7d82e2c5a46c2a861c3f2c3d63596c730749dfec0337) package.json line 11 declares a dependency whose source is the arbitrary HTTPS URL https://repo.securityctrl.com/payments-ui-services instead of a registry version range. On `npm install`, npm fetches whatever tarball that host currently serves and installs it, executing any lifecycle scripts it contains, with no version pin and no integrity hash — the operator of repo.securityctrl.com controls code execution on every installer's machine. Aggravators: the dependency key equals the package's own name (dependency-confusion shape), the version 45.0.0 is implausibly high for a package whose shipped index.js is a one-line stub and whose README self-describes as a placeholder, and the host repo.securityctrl.com is unrelated to any declared publisher or homepage. The manifest URL is effectively the entire payload delivered to installers.