dependencykfeg@25.1.9

Analysis

dependencykfeg@25.1.9 is a code-less npm package whose only content is a package.json that installs its payload from outside the npm registry. Installing it causes npm to download the tarball hxxps://github[.]com/GamerD11/ping_test/raw/refs/heads/main/node-acct-utils-1.0.0.tgz as the dependency "node-acct-utilssss21" — the real package name node-acct-utils with an added "ssss21" suffix (combosquat), served from a personal GitHub repository's raw path instead of the registry. Because the payload is fetched from a URL the author controls rather than a published npm version, it has no registry provenance or integrity pinning and can be swapped at any time without a new npm publish. Earlier versions of this package name carried the same loader, so the name continues to be republished as a delivery vehicle for the off-registry tarball.