resolve-audit@99.9.1

Analysis

resolve-audit@99.9.1 is an empty package (index.js exports an empty object, no install hooks) that declares a single dependency, ltidisafe, fetched from a non-registry CDN URL (hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-3[.]6[.]6[.]tgz) rather than the npm registry. Installing the package pulls and executes this off-registry tarball from an attacker-controlled Google Cloud Storage bucket, delivering the payload outside the registry's scanning and integrity controls. The package ships no functional code of its own; its entire purpose is to install the remote dependency.