Malicious code in multi-acct (npm)

multi-acct@99.99.99 was published to npm as a near-empty wrapper package designed to deliver malicious code. The package's index.js contains only a two-line stub returning name and version literals, with generic placeholder metadata (author listed as 'Package Registry', repository URL pointing to example.com-style placeholder).

The malicious payload is delivered through a single functional dependency, vector-cursor-stream-engine, which is not resolved from the npm registry. Instead, it is hardcoded to fetch from a third-party HTTPS URL: https://artifacts.yosiroute.com/npm/vector-cursor-stream-engine. The package.json shrinkwrap marks this dependency with hasInstallScript:true.

When a developer runs npm install, npm downloads the tarball from artifacts.yosiroute.com and executes its lifecycle scripts, granting arbitrary code execution to whoever controls that host. The URL is unpinned and carries no integrity hash, meaning the delivered bytes can change at any time without detection.

This attack pattern matches a dependency-confusion / lure package where the real payload is delivered through the fetched sub-tarball rather than embedded in the wrapper itself. The incident was identified by the OpenSSF malicious-packages project.