qbo-ui-services@45.0.0

Analysis

A 534-byte "placeholder" package whose manifest declares a self-dependency at the non-registry URL hxxps://repo[.]securityctrl[.]com/qbo-ui-services. Installing it makes npm fetch a tarball from that attacker-controlled host for the qbo-ui-services dependency, enabling arbitrary code delivery at install time. The package claims to "prevent dependency confusion" but actually introduces it via a non-registry self-dependency URL.