Malicious code in kepler (npm)

The kepler npm package version 2.0.999 was found to declare a runtime dependency, flag-serial-object-syntax, as an HTTP URL to a third-party host (https://artifacts.yosiroute.com/npm/flag-serial-object-syntax) rather than resolving it from the npm registry. The package's shrinkwrap configuration marks this dependency with hasInstallScript: true, enabling automatic execution of lifecycle scripts during installation.\n\nWhen a developer runs npm install kepler, the package manager fetches an unpinned, unverified tarball from artifacts.yosiroute.com and executes its lifecycle scripts with the installer's privileges. The URL contains no version pinning and no integrity metadata, meaning its contents can be changed at any time by the operator of the third-party host.\n\nThe kepler package itself contains only placeholder metadata (author "Package Registry", repository "github.com/example/...") unrelated to yosiroute.com and ships no legitimate first-party code that would justify sourcing a dependency off-registry. This dependency-tree-hijack pattern—an off-registry, mutable, install-scripted tarball pulled transitively—enables arbitrary code execution under the installer's privileges.\n\nThe incident was identified by the OpenSSF's malicious-packages project and reported via GitHub Security Advisory GHSA-4vx4-f3cp-29qp.