wm-idp-sdk@1.2.0

Analysis

wm-idp-sdk@1.2.0 declares a dependency on the legitimate `ky` HTTP client package but pins it to `hxxps://registry[.]ctzbg[.]com/wm-idp-sdk/ky` — a non-standard, attacker-controlled registry instead of the official npm registry. When installed, npm resolves `ky` from ctzbg[.]com, which can serve arbitrary malicious code. The package's own bundled `dist/main.js` never actually imports `ky` — the dependency is declared solely as a delivery vector. The publisher email is obfuscated and this is the only published version.