eslint-publish-release@99.9.1

Analysis

eslint-publish-release@99.9.1 is an empty package (index.js exports an empty object) whose only purpose is to install a dependency named ltidisafe fetched from a non-registry CDN at hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-3[.]6[.]4[.]tgz. The package impersonates eslint's release tooling and ships at version 99.9.1, a dependency-confusion shape: installing it pulls attacker-controlled code from the off-registry Google Cloud Storage bucket rather than the npm registry. The bundled code itself is inert; the malicious payload is delivered through the off-registry dependency.