MAL-2026-15530

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (011485304eea045bddd134da5fdabfcf9d96acd0f2c78e1800a4c32674a5788c) package.json declares a dependency whose key equals the package's own name (`confluence-create-content`) and whose value is a bare HTTPS URL, `https://repo.securityctrl.com/confluence-create-content`, instead of a registry version range. On `npm install`, npm fetches whatever bytes that URL returns and installs them, running any lifecycle scripts contained in them with no version pin and no integrity check. The shipped `index.js` is an inert stub, so the manifest URL is effectively the entire delivered payload. The self-named dependency shape also creates dependency-confusion pressure: any environment resolving this package name pulls content from the third-party host rather than the registry.