lil-swisgom-hlepers@1.0.0

Analysis

Package lil-swisgom-hlepers@1.0.0 is a stub that declares a dependency on lil-swisgom-hlepers-core resolved from the external host hxxps://registry[.]grivy-packages[.]com/lil-swisgom-hlepers-core/-/lil-swisgom-hlepers-core-1[.]0[.]0[.]tgz instead of the public npm registry. This causes npm to fetch and execute code from an attacker-controlled server during installation, bypassing standard dependency resolution. The published tarball itself is empty (module.exports = {} with echo-only install hooks), making the package appear benign while the real payload is served remotely from registry[.]grivy-packages[.]com.