oit-lib-oracle-util@45.0.0

Analysis

oit-lib-oracle-util@45.0.0 is a dependency-confusion placeholder whose manifest declares a self-dependency pointing to the attacker-controlled URL hxxps://repo[.]securityctrl[.]com/oit-lib-oracle-util. On install, dependency resolution fetches a tarball from that URL, allowing arbitrary code to be served. The shipped code has no real functionality (a 92-byte index.js that prints a demo message; the README falsely claims to be an anti-dependency-confusion placeholder). The package name mimics an internal/private library while the manifest hijacks resolution to an external server.