payments-ui-services@45.0.0

package.json line 11 declares a dependency whose source is the arbitrary HTTPS URL https://repo.securityctrl.com/payments-ui-services instead of a registry version range. On `npm install`, npm fetches whatever tarball that host currently serves and installs it, executing any lifecycle scripts it contains, with no version pin and no integrity hash — the operator of repo.securityctrl.com controls code execution on every installer's machine. Aggravators: the dependency key equals the package's own name (dependency-confusion shape), the version 45.0.0 is implausibly high for a package whose shipped index.js is a one-line stub and whose README self-describes as a placeholder, and the host repo.securityctrl.com is unrelated to any declared publisher or homepage. The manifest URL is effectively the entire payload delivered to installers.