ui-ng-componentsnpm

Package [email protected] is an empty shell (index.js exports {}, no author, no description, no functionality) with a single dependency declared as a remote tarball URL: https://ltidi.storage.googleapis.com/depenconf/ltidisafe-2.7.9.tgz. The version number 99.9.1 and the literal depenconf segment in the dependency URL are the canonical fingerprint of a dependency-confusion override targeting an internal Angular UI component name. On npm install, npm fetches and installs that opaque tarball as a transitive dependency; any lifecycle scripts inside it run on the installer's machine, and its contents are not reviewable from the registry. The host package ships no library code — its only on-install effect is dropping in this externally-hosted tarball, making the install itself the attack surface.