Logo
npm

@bx-ui-framework/microfrontend@15.0.0

Vulnerability report · Last retrieved from osv.dev September 4, 2026 at 2:56 AM UTC

Malicious

OSV ID

MAL-2026-15868

Ecosystem

npm

Summary

package.json declares a runtime dependency microfrontend whose source is a bare HTTPS URL at https://repo.artifactorymanager.com/bx-ui-framework/microfrontend rather than a version on the npm registry. The URL carries no version, commit, or hash pin, so npm install fetches whatever tarball is currently served at that location and executes any lifecycle scripts and code it contains inside the installer's dependency tree. The artifactorymanager.com domain is unrelated to any established publisher for this scope, and the tarball contents can change at any time without a version bump.

Source: amazon-inspector (e1680cbcfbae85350989b4d123a117deb73e45aad1ee7aa339cdcef34d3fbe30)

Protect your entire dependency tree

Scan your lock files automatically on every PR. Block malicious packages before they reach production.