unleash-js@99.9.1

Analysis

Critical external_url_dep finding: package depends on hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-2[.]7[.]7[.]tgz - an external URL dependency bypassing npm registry integrity checks. Publisher email [account] is throwaway-looking. Package is minimal (350 bytes) stub with version 99.9.1 suggesting impersonation or attack testing. External URL deps are a known supply chain attack vector allowing arbitrary code injection. Not dismissible - clear malicious pattern.