@dexwilt/mf-node@2.7.46

Analysis

A clone of the module-federation Node runtime published under the scoped name @dexwilt/mf-node. Its package.json substitutes the standard node-fetch dependency with the alias npm:@glitchpad/node-fetch@2.7.2, a package that is not present in the public npm registry — a dependency-substitution vector that would install attacker-controlled code (including any install scripts) if that package were published. The bundled runtime fetches and eval-executes remote chunk code from configured federation hosts.