tabbables@45.0.0

Analysis

Dependency confusion / typosquat supply-chain package. The package declares itself as a dependency pointing to the external non-registry host hxxps://repo[.]securityctrl[.]com/tabbables, so that npm's dependency resolution attempts to fetch the payload from that attacker-controlled server. The package's code is a trivial decoy (console.log); the real attack vector is the self-dependency redirection to a remote host during install.