The npm package @bx-ui-framework/common versions 1.2.0 and 15.0.0 declare a self-referential dependency with a URL pointing to an external repository (https://repo.remoteknight.com/bx-ui-framework/common) instead of a version range. This causes npm to fetch and install code from that URL during installation, executing any lifecycle scripts it contains. The package's shipped index.js is inert, making the dependency declaration the primary attack vector. Whoever controls the external repository can execute arbitrary code on any machine installing the package, exploiting a dependency confusion technique.