fast-xml-tagger@1.1.0

Analysis

fast-xml-tagger@1.1.0 contains no executable code of its own — only a package.json. Its manifest declares an optionalDependency that causes npm to download and install a remote tarball from a non-registry host: hxxps://5k9o5gw5[.]instances[.]httpworkbench[.]com/test[.]tgz. Installing the package therefore fetches and installs an unverifiable third-party tarball from an external host, whose contents are not shipped with the package.