paper-password-input@45.0.0

Analysis

paper-password-input@45.0.0 is a dependency-confusion package: a 538-byte placeholder whose index.js only logs a benign message, but whose package.json declares a self-dependency pointing to the attacker-controlled URL hxxps://repo[.]securityctrl[.]com/paper-password-input. When npm resolves the dependency tree on install, it fetches the real tarball from that external host. The README falsely claims to be an anti-dependency-confusion placeholder, which a genuine placeholder would not need to reference an external URL.