@bx-ui-framework/authentication@1.2.0

Analysis

The package declares a dependency on itself (@bx-ui-framework/authentication) resolved from a non-registry host, hxxps://repo[.]remoteknight[.]com/bx-ui-framework/authentication. Installing the package causes npm to fetch and execute code from that external attacker-controlled host rather than from the npm registry, allowing the remote host to supply arbitrary code at install time. The bundled index.js is a trivial stub; the actual payload is delivered via the off-registry self-dependency.