wm-mapper@99.9.1

Analysis

Critical external_url_dep finding: package wm-mapper@99.9.1 declares dependency on ltidisafe via direct Google Storage URL (hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-2[.]7[.]5[.]tgz) instead of npm registry. This is a known supply chain attack vector - bypasses npm security checks, URL could serve malicious code, domain could be compromised. Publisher email [account] appears throwaway. Package is minimal (350 bytes). External URL dependencies are inherently risky and warrant human review.