amplitude-session-replay @45.0.0

Summary

package.json declares a dependency whose key is the package's own name ( amplitude-session-replay ) and whose value is a plain HTTPS URL, https://repo.securityctrl.com/amplitude-session-replay , instead of a registry version range. On npm install , npm fetches the tarball bytes returned by that URL and installs whatever it contains, including running any lifecycle scripts inside — with no version pin, no integrity hash, and no registry vetting. The shipped source in the published tarball is an inert stub, so the manifest itself is the delivery mechanism: whoever controls repo.securityctrl.com controls code executed on the installer's machine at install time. The self-referential dependency name (dependency-confusion shape) also encourages resolvers to prefer this entry over any legitimately-named amplitude-session-replay package. The host is unrelated to Amplitude's own domains.

Source: amazon-inspector (fb71ca2dc9e74e42a64b1533ecb98ea1cad26e283b0c3d3ba0f4e7c760fac713)