search-reservation@55.0.0

Analysis

package search-reservation@55.0.0 performs a dependency-confusion attack using a self-referencing external dependency. Its manifest declares the dependency "search-reservation" pointing to the attacker-controlled URL hxxps://repo[.]securityctrl[.]com/search-reservation. When npm installs this package, the package manager resolves the self-dependency by downloading and installing a tarball from that external URL, allowing the attacker to serve arbitrary code onto the installer's system. The shipped index.js is an inert 92-byte stub that logs a benign message; the entire malicious mechanism operates at the manifest/metadata layer via the external dependency resolution.