prm-bundles@45.0.0

Analysis

An install-time payload-fetch shell. The manifest declares a self-dependency on its own name at the non-registry URL hxxps://repo[.]securityctrl[.]com/prm-bundles, so installing it causes npm to resolve the package name from that external host and fetch whatever tarball it serves (with attendant lifecycle-hook code execution). The published source is deliberately empty (531 bytes, a trivial console.log, README claiming it is a "placeholder to prevent dependency confusion"), offloading the real payload to install-time dependency resolution from the attacker-controlled host.