claims-acct-unlock@25.2.1

Analysis

claims-acct-unlock@25.2.1 ships no code: the tarball contains only package.json (317 bytes) while the manifest points "main" at an index.js that is not present. Its only functional content is a dependency resolved from a raw GitHub tarball instead of the npm registry — dependencies: { "node-acct-utilssss21": "hxxps://github[.]com/GamerD11/ping_test/raw/refs/heads/main/node-acct-utils-1[.]0[.]0[.]tgz" }. Installing this package therefore downloads and unpacks an externally hosted, unsigned tarball from a personal GitHub repository, which bypasses registry integrity and audit records entirely; the dependency name (node-acct-utilssss21) and repository name (ping_test) do not correspond to any published npm package. The package is a placeholder that reserves the name and delegates all executable content to that remote GitHub-hosted archive, and it reuses a package name that has shipped malicious versions before.