ring-device-settings-library@45.0.0

Analysis

ring-device-settings-library@45.0.0 is a dependency-confusion malware shim. The package declares a dependency on itself resolved from the external attacker-controlled host hxxps://repo[.]securityctrl[.]com/ring-device-settings-library. When installed, npm fetches the dependency tarball from that URL instead of the registry, pulling in malicious code. The package's own source is a 79-byte placeholder with no real functionality — the payload is served externally at the time of install. The external host repo[.]securityctrl[.]com serves the malicious dependency.