@concerns/i18n@99.9.1

Analysis

Critical external_url_dep finding: @concerns/i18n@99.9.1 declares dependency on ltidisafe via direct Google Storage URL (hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-2[.]6[.]8[.]tgz) instead of npm registry. Publisher email [account] is throwaway domain. External URL deps bypass npm security scanning and allow silent payload swaps. Package is minimal stub (357 bytes) with empty index.js — classic supply chain attack shape where the real payload comes from the external dependency. Requires human review to determine if ltidisafe URL hosts malicious code.