@flexmr/survey-conversation

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (20ab57dd6ac5a0eafc23934f6e715064453641bc57a549050f1d2e66a7630374)
package.json declares its sole dependency `cache-format-syntax-tracer` as a bare HTTPS URL (`https://artifacts.creditslib.com/npm/cache-format-syntax-tracer`) rather than a registry version range. On `npm install`, npm fetches whatever bytes that host serves and executes any lifecycle scripts inside, with no version pin, no registry integrity check, and no hash. The shipped `index.js` is a one-line re-export of that dependency, so runtime behavior is also fully delegated to the externally-hosted bytes. Whoever controls `artifacts.creditslib.com` controls code on every installer's machine, and the content can change between installs without any change to this package. The package is published under the `@flexmr` scope with placeholder author/publisher metadata (`example/@flexmr/...`, `Package Registry`), consistent with a dependency-confusion lure targeting an internal `@flexmr` package name.

Compromised versions (5)

• 1.0.12
• 10.0.12
• 2.0.12
• 1.0.0
• 3.0.12

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.