merchantweb-lang-cookie-reset @99.99.99

Summary

package.json and npm-shrinkwrap.json resolve the sole dependency packet-table-thread-stream to https://artifacts.yosiroute.com/npm/packet-table-thread-stream , a non-npm-registry host unrelated to the declared publisher (github.com/example/merchantweb-lang-cookie-reset, author Package Registry , description Generated package ). The dependency is marked hasInstallScript: true , so on npm install npm downloads a tarball from this third-party host and runs its lifecycle scripts on the installer's machine. There is no version pinning to a registry artifact and no integrity hash for the third-party URL; the bytes served are mutable and controlled by that host. The package itself is a stub whose index.js only re-exports name/version, so the sole effect of installing it is to pull and execute code from artifacts.yosiroute.com.

Source: amazon-inspector (5b095c93acc24b5979596513da816a08ab69de453c893e346f8c825985d3ec0b)