mazemapnpm

package.json declares its only dependency ltidisafe as a direct HTTPS tarball URL (https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.0.2.tgz) hosted on a generic Google Cloud Storage bucket rather than resolved from the npm registry. On npm install mazemap, npm fetches and installs that arbitrary tarball, executing any lifecycle scripts (preinstall/install/postinstall) it contains — the tarball is bucket-owner-mutable and not subject to registry vetting. The package itself is a hollow lure: index.js is a 35-byte module.exports = {};, with no description, no author, ISC default license, and version 99.9.1 — a recognized dependency-confusion technique for overriding an internal package of the same name via a higher public version. The bucket path segment is literally depenconf. The combination of hollow main, inflated version, anonymous GCS-hosted dependency, and name collision with a real product (MazeMap) is a dependency-confusion / smuggling shape whose only on-install effect is to pull and execute attacker-controlled code from a non-registry source.