@flexmr/survey-client@10.0.12

Analysis

@flexmr/survey-client@10.0.12 is a stub package whose only function is to pull code from outside the npm registry. Its package.json declares a single dependency, marker-index-symbol-schema, as a raw tarball URL — hxxps://artifacts[.]creditslib[.]com/npm/marker-index-symbol-schema — instead of a registry version range, and index.js contains nothing but `module.exports = require('marker-index-symbol-schema')`. Installing the package therefore causes npm to fetch and execute a tarball from a third-party host that is not covered by the npm registry's integrity checks or audit trail, and the fetched code runs with the installer's privileges. The package ships no other code, no lifecycle scripts, no obfuscation and no README beyond a generated template; its declared repository URL points at github[.]com/example/@flexmr/survey-client, which does not host this package. The same non-registry artifact host is referenced by the related stub @flexmr/survey-conversation@1.0.0, which declares a different dependency name (cache-format-syntax-tracer) at the same hxxps://artifacts[.]creditslib[.]com/npm/ path prefix.