MAL-2026-16064

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (ce3874d2c55544bbbf59b6a60c3002b13e242fb53160a455597b13fdd37231f8) package.json declares a dependency whose key equals the package's own name (bx-ui-view) and whose value is a plain HTTPS URL (https://package-access.pages.dev/bx-ui-view) rather than a registry version range. On `npm install`, npm resolves this URL, downloads whatever tarball is served, and executes any lifecycle scripts inside it — with no version pin, no integrity check, and no hash/signature verification. The shipped index.js is a 3-line inert stub, so the manifest line is the entire published surface: the installer receives whatever content the operator of package-access.pages.dev chooses to serve at install time. The self-name + off-registry URL + stub source combination is the dependency-confusion / smuggled-payload shape, and the pages.dev host is unrelated to any registry or declared publisher domain.