uphold-sdk-javascript-extensions@99.9.10

Analysis

Package combosquats the legitimate Uphold financial SDK name with an inflated version number (99.9.10). It ships with an empty code file and no functionality. Both dependencies and devDependencies resolve the "base-package" dependency from the non-registry URL hxxp://npm[.]ezequielpuig[.]space/, an attacker-controlled server. When installed, npm resolves this dependency from the custom registry, enabling the attacker to serve arbitrary malicious code and payloads at install time.