Description

dist/index.js issues fetch() calls to https://base-ui-pro-registry.l-dimitrov.workers.dev in addition to https://registry.npmjs.org. The Cloudflare Workers host is controlled by an individual (l-dimitrov.workers.dev) rather than any official registry or vendor infrastructure, and the package name 'base-ui-cli' evokes the unrelated Base UI component library, suggesting a lookalike/imposter shape. Routing package-manager-adjacent traffic through an author-controlled proxy that mirrors registry.npmjs.org creates a channel for delivering attacker-substituted package content or credential-bearing requests to a third-party host.

Mitigation

Aliases