test-flow-entire5@1.0.0

Analysis

test-flow-entire5@1.0.0 is a dependency-confusion package that declares its sole dependency as a full HTTPS URL to an attacker-controlled server (artifacts[.]stg[.]yosiroute[.]com) rather than the npm registry. The npm-shrinkwrap.json reveals a full dependency chain — ticket-atomic-memo-plugin, digest-loader-field-schema, and script-token-struct-memo — all resolved from the same external host. The package itself is a trivial stub (73 bytes) whose only function is to pull in this external dependency tree at install time, giving the attacker arbitrary code execution on any system that installs it.