cspell-esm@99.9.1

Analysis

cspell-esm@99.9.1 is an empty package (index.js exports an empty object) that installs a dependency named ltidisafe fetched from a non-registry Google Cloud Storage URL (hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-3[.]6[.]7[.]tgz). The package name mimics the legitimate cspell spell-checker and is published at version 99.9.1, and the ltidisafe dependency is not available on the npm registry, so its contents are delivered entirely from the external CDN bucket at install time.