modao-capture

The fragment contains no direct evidence of malware because it is lockfile metadata and exposes no executable behavior. However, use of the nonstandard npm.abczs.cn registry over HTTP is a significant supply-chain integrity concern. The integrity fields reduce but do not eliminate risk, particularly if the lockfile or its hashes were already compromised.