The npm package @bx-ui-framework/authentication versions 1.2.0 and 15.0.0 declare a runtime dependency on a package fetched directly from an untrusted HTTPS URL rather than the official npm registry. This dependency is named 'microfrontend' and is sourced from https://repo.artifactorymanager.com/bx-ui-framework/authentication, which is unrelated to the package's publisher identity. Because there is no version pinning, integrity hash, or signature verification, the content fetched can be fully controlled and changed by the operator of that domain, potentially delivering malicious code during installation.