@grab-food/order-sdk-web@1.0.1

Analysis

Package @grab-food/order-sdk-web is an empty stub (module.exports = {} with echo-only lifecycle hooks) that declares a dependency fetched from a non-npm registry at registry[.]grivy-packages[.]com. The dependency tarball URL is hxxps://registry[.]grivy-packages[.]com/grab-food-order-sdk-web-core/-/grab-food-order-sdk-web-core-1[.]0[.]1[.]tgz. When installed, npm will download and execute code from this external, untrusted host. The package has no repository, no meaningful functionality, and its scoped name mimics the Grab food-delivery brand. The external registry host (grivy-packages[.]com) is the IOC for the second-stage payload delivery.