mkt-ui-library@45.0.0

Analysis

mkt-ui-library declares a self-dependency via an attacker-controlled external URL (hxxps://repo[.]securityctrl[.]com/mkt-ui-library) to serve a malicious tarball at install time while keeping the registry publish clean. The package is a ~533-byte stub with a benign index.js that logs a message and a README claiming it is a placeholder to prevent dependency confusion — but a real placeholder would not self-reference via an external-URL dependency. The external URL can serve any payload at install time without leaving traces in the registry tarball.