passwordcracker@1.1.1

Summary

package.json at line 41 declares the sole runtime dependency node-net-pool as an off-registry HTTPS tarball pointing at the main branch of https://github.com/trktgq0wbre1/node-net-pool/archive/refs/heads/main.tar.gz, with no version pin, no commit SHA, and no integrity hash. On npm install, npm fetches whatever that mutable branch currently contains and installs it, running any lifecycle scripts inside the resulting package. The GitHub account hosting the tarball is unrelated to any established publisher, and the shipped source references pool functionality that is not implemented locally, so the external tarball supplies code that this package depends on at runtime. The package also ships an index.js that targets Discord's /api/v9/mfa/finish and vanity-url endpoints with caller-supplied token and password values and disables TLS verification against discord.com, canary.discord.com, and ptb.discord.com — an offensive tool operating on operator-supplied credentials rather than installer-owned data, which does not by itself attack the installer but confirms the package's hostile posture.

Source: amazon-inspector (b3aa1deb3b0d3ec4ce0e4694f806b9887b286764b96f177bc41deec309b9ddc3)