@coterie-baby/common@99.9.1

Analysis

Critical external_url_dep finding is legitimate. Package @coterie-baby/common@99.9.1 declares dependency on hxxps://ltidi[.]storage[.]googleapis[.]com/ltidisafe-2[.]2[.]1[.]tgz - an arbitrary external URL bypassing npm registry security. Publisher email [account] is a throwaway domain. Version 99.9.1 suggests version squatting. Tiny package (358 bytes) with no legitimate purpose other than pulling external code. This is a classic supply chain attack vector - external dependencies allow attackers to serve malicious code outside npm's security controls. Not a false positive.