payments-ui-services

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (e4b49e2f4d16837b49ca7d82e2c5a46c2a861c3f2c3d63596c730749dfec0337)
package.json line 11 declares a dependency whose source is the arbitrary HTTPS URL https://repo.securityctrl.com/payments-ui-services instead of a registry version range. On `npm install`, npm fetches whatever tarball that host currently serves and installs it, executing any lifecycle scripts it contains, with no version pin and no integrity hash — the operator of repo.securityctrl.com controls code execution on every installer's machine. Aggravators: the dependency key equals the package's own name (dependency-confusion shape), the version 45.0.0 is implausibly high for a package whose shipped index.js is a one-line stub and whose README self-describes as a placeholder, and the host repo.securityctrl.com is unrelated to any declared publisher or homepage. The manifest URL is effectively the entire payload delivered to installers.

Compromised versions (1)

• 45.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.