mfaatest @1.0.0

Summary

package.json declares dependency node-net-pool with its value set to an arbitrary HTTPS tarball URL ( https://limbomail.com/api/attachment/fpwvxc__9DvM.Bjuueu1K2SkBC_KkgATls-oq05UsrNNY/pkg.tgz ) rather than a registry version range. On npm install , npm fetches whatever bytes limbomail.com returns and installs them, executing any lifecycle scripts inside the fetched tarball. The source is unpinned, integrity-unchecked, and hosted on a domain unrelated to the package's stated publisher; the content can be swapped at any time by whoever controls that host. The package's own description claims 'zero runtime dependencies', contradicting the presence of this off-registry dependency and matching the smuggled-dropper shape.

Source: amazon-inspector (73e4ce261829117e316f9152160cdcb35c6ba66064f631baba1f8d528673b584)