kyksworldcup4@1.0.0

Analysis

kyksworldcup4@1.0.0 is a dependency-confusion package that re-exports a dependency from an attacker-controlled external URL. The package's index.js is a single line re-exporting "smart-schema-lib", which is declared as a dependency at hxxps://artifacts[.]stg[.]yosiroute[.]com/npm/smart-schema-lib — an external host outside the npm registry. When a consumer installs and requires this package, npm resolves the dependency from that external URL, giving the host control over what code is served. The package has no lifecycle hooks, no obfuscation, and no repository.