bx-ui-view@1.0.0

Analysis

The package declares a dependency on itself resolved from an external non-registry URL (hxxps://package-access[.]pages[.]dev/bx-ui-view) instead of the npm registry. Installing the package causes npm to fetch and execute code for the bx-ui-view dependency from that attacker-controlled host, which can serve arbitrary code during install. The bundled tarball is a trivial stub; the malicious behaviour is the external-URL dependency that redirects dependency resolution to a non-registry host.