The @bx-ui-framework/microfrontend npm package version 15.0.0 declares a runtime dependency on a package fetched from an untrusted HTTPS URL (https://repo.artifactorymanager.com/bx-ui-framework/microfrontend) instead of the official npm registry. This URL is not associated with the legitimate package publisher and serves a tarball without version or hash pinning, allowing arbitrary code execution during installation.