sycm-vendors@55.0.0

Analysis

Package sycm-vendors@55.0.0 is a supply-chain attack that hijacks npm install resolution via a malicious dependency entry. Its package.json declares a self-referencing dependency with a tarball URL pointing to an attacker-controlled server at hxxps://repo[.]securityctrl[.]com/sycm-vendors. When npm resolves this dependency during install, it fetches a malicious tarball from that external host. The package's own shipped code is a 92-byte stub that prints a benign message; the README claims to be a "placeholder" — both are camouflage. The actual payload is delivered from the external URL at install time.