Malicious / Dangerous spec resolver to custom URL

[fraxken]

Custom spec resolver can be used to fake a package name (such as axios in the following example)

[fraxken]

https://snyk.io/blog/exploring-extensions-of-dependency-confusion-attacks-via-npm-package-aliasing/