tabbables @45.0.0

Summary

package.json at line 11 declares a dependency whose key equals the package's own name ( tabbables ) and whose value is the raw HTTPS URL https://repo.securityctrl.com/tabbables rather than a registry version range. On npm install , npm fetches whatever tarball that URL currently serves and installs it, executing any lifecycle scripts it contains, with no version pin, no integrity/hash check, and no registry provenance. The shipped index.js is an inert stub, so the manifest URL is the sole payload-delivery mechanism; the tarball's behavior can be changed at any time by whoever controls repo.securityctrl.com. The self-referential dependency key also produces a dependency-confusion shape (an implausibly high 45.0.0 version competing with any internal package of the same name).

Source: amazon-inspector (2fc629ecaf81d15034bbba33363e63776d106e6f58932e889baa4cb748b689eb)