fetch-runtime @1.5.0

Summary

Package name is 'fetch-runtime' but the source is a copy of npm's 'make-fetch-happen' (repository, README, and author metadata all reference make-fetch-happen). lib/index.js adds two exported constants, userAgent and fetchEngine, holding opaque base64-shaped strings that are never used inside this package: they are not decoded, invoked, fetched, exec'd, or transmitted at install or import time. The package has no install/lifecycle scripts and no top-level network I/O. In isolation, installing or requiring fetch-runtime does not perform exfiltration, remote code execution, credential theft, or persistence. The concerning shape is the rebrand of a well-known library combined with planted inert blobs on exported names — a pattern consistent with a two-stage design where a separate consumer package would read these exports and use them as a URL/key/payload — but no such consumer or use is present within this tarball, and the name resemblance is not by itself a threat.

Source: amazon-inspector (ab5c49646ea7e22e74073aa7d8c9596d7d93100c429033383e975a2ab080de28)