multi-acct@1.0.0

Analysis

multi-acct@1.0.0 is a dependency-confusion package that pins its sole dependency (vector-cursor-stream-engine) to a non-registry URL at artifacts[.]yosiroute[.]com. The npm-shrinkwrap.json confirms the remote dependency has an install script (hasInstallScript: true), meaning npm will fetch and execute arbitrary code from the attacker-controlled server at install time. The package itself is a trivial wrapper with no functional code. IOC: hxxps://artifacts[.]yosiroute[.]com/npm/vector-cursor-stream-engine, domain: artifacts[.]yosiroute[.]com.