sentrykit@30.0.0

Analysis

This package is a dependency-confusion / combosquat attack. The tarball itself is a small shell containing a benign placeholder, but package.json declares a self-dependency pointing to hxxps://repo[.]securityctrl[.]com/sentrykit — an external, non-npm HTTPS URL under attacker control. When npm installs this package and resolves its dependency tree, it fetches and installs the payload from that remote server automatically. The dependency fetched from that URL has been independently confirmed as malware. The package name "sentrykit" mimics the legitimate Sentry SDK namespace to trick developers into installing it.