external_deps_enjoyer@1.0.0

Summary

package.json declares dependencies and optionalDependencies whose specifiers point at non-registry, attacker-controlled or mutable sources rather than the npm registry. Listed sources include a Discord CDN attachment tarball (cdn.discordapp.com/attachments/.../runtime.tgz), plain-HTTP tarballs at bare IPs (http://203.0.113.77:8443/drop/pkg.tgz, HTTP://198.51.100.44/.../pkg.tgz), git://203.0.113.91/hidden/repo.git, an ngrok tunnel (abc123xyz.ngrok-free.app), rentry.co raw content, gist shorthands (gist:c0ffee00deadbeef), and github/gitlab/bitbucket shorthands to throwaway repos (tmp-drop-8821/...). Specifier keys are duplicated with case variants (tarball-http vs tarball-HTTP, github-shorthand vs GITHUB-shorthand) and mix uppercase URI schemes with scp-style git refs and local path forms (link:, portal:, file:, /tmp/..., \Windows\Temp\...), a pattern engineered to evade regex-based scanners. On npm install, npm fetches each specifier and executes any lifecycle scripts the fetched package declares; because the sources are mutable and controlled by third parties, the code that runs is whatever the operators of those hosts currently serve.

Source: amazon-inspector (8d4909b60251f0448ff7bc689262f363e3ec4c2cebf82abe3eb0c7f8769931a6)