npm-extension@45.0.0

Analysis

npm-extension@45.0.0 is a dependency-confusion/combosquat package that declares a self-dependency pointing to the non-registry external URL hxxps://repo[.]securityctrl[.]com/npm-extension. During npm install this URL is fetched and resolved, letting the attacker serve arbitrary payloads. The shipped stub code is a decoy; the external-URL self-dependency is the attack vector, and the high version number (45.0.0) is typical of dependency-confusion takeovers.