payments-ui-services@45.0.0

Analysis

payments-ui-services@45.0.0 is a dependency-confusion package that declares a self-dependency pointing to hxxps://repo[.]securityctrl[.]com/payments-ui-services. When npm resolves this on install, it fetches a tarball from an attacker-controlled host that can deliver arbitrary payloads independently of the npm-stored stub. The shipped code is a 538-byte three-file stub with no real functionality, and the README falsely claims to be an anti-dependency-confusion placeholder. The attacker can update the remote tarball to add postinstall hooks, credential stealers, or second-stage payloads affecting every installer.