lusha-iam-widgets@1.5.2

Analysis

The package pins its node-fetch dependency to a full URL pointing at an attacker-controlled custom registry (registry[.]ctzbg[.]com) instead of a standard npm semver range. When npm installs this package, it fetches node-fetch from that external registry, which the attacker controls and can serve arbitrary code as that dependency at any time. The package ships benign-looking React UI components (styled-components, MultipleInvites) as camouflage; the attack vector is the dependency resolution itself. IOC: registry[.]ctzbg[.]com.