vui-gateway@45.0.0

Analysis

Dependency-confusion package squatting an internal/private package name. The package declares a self-referencing dependency pointing to an attacker-controlled external URL (hxxps://repo[.]securityctrl[.]com/vui-gateway). When npm resolves this non-registry dependency, it fetches a tarball from the remote host (repo[.]securityctrl[.]com), enabling the attacker to serve arbitrary malicious content at install time. The published package itself is a minimal 532-byte stub with placeholder code, indicating the dependency URL is the intended payload delivery channel.