sort-destructure-keys@7.9.0

Analysis

The package ships only a minimal stub (index.js logs 'Hello, world!') but declares a dependency 'ui-styles-pkg' that resolves from an external non-npm HTTP registry at hxxp://npm[.]jpartifacts[.]com/npm/sort-destructure-keys. This URL appears in both dependencies and devDependencies in package.json. When the package is installed, npm resolves 'ui-styles-pkg' from this attacker-controlled host, which can serve arbitrary code at install time — an artifact-poisoning / dependency-confusion vector. The C2 registry host is npm[.]jpartifacts[.]com (HTTP, port 80).