ux-metrics-client-interaction-subscriber@45.0.0

Analysis

Package declares a dependency on itself resolved from the external URL hxxps://repo[.]securityctrl[.]com/ux-metrics-client-interaction-subscriber. During npm install, this causes the package manager to fetch code from an attacker-controlled remote host, which can serve arbitrary malicious content. The local tarball is a trivial placeholder with no real functionality — the actual payload is delivered at install time from the external URL.