tabbables

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (2fc629ecaf81d15034bbba33363e63776d106e6f58932e889baa4cb748b689eb)
package.json at line 11 declares a dependency whose key equals the package's own name (`tabbables`) and whose value is the raw HTTPS URL `https://repo.securityctrl.com/tabbables` rather than a registry version range. On `npm install`, npm fetches whatever tarball that URL currently serves and installs it, executing any lifecycle scripts it contains, with no version pin, no integrity/hash check, and no registry provenance. The shipped index.js is an inert stub, so the manifest URL is the sole payload-delivery mechanism; the tarball's behavior can be changed at any time by whoever controls repo.securityctrl.com. The self-referential dependency key also produces a dependency-confusion shape (an implausibly high 45.0.0 version competing with any internal package of the same name).

Compromised versions (1)

• 45.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.