@bx-ui-framework/microfrontend@15.0.0

Analysis

The package declares a dependency "microfrontend" pinned to a non-registry URL (hxxps://repo[.]artifactorymanager[.]com/bx-ui-framework/microfrontend) instead of the npm registry. Installing the package causes npm to fetch and install this dependency from that external host, which is not verifiable as legitimate; if the host is compromised, arbitrary code is executed at install time. The package itself is a trivial stub with no other functionality.