knip-bun@99.9.1

Analysis

knip-bun@99.9.1 is an empty package (index.js exports an empty object) whose only dependency, "ltidisafe", is fetched at install time from a non-registry Google Cloud Storage URL: hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-3[.]6[.]8[.]tgz. Installing this package downloads and installs an arbitrary tarball from that attacker-controlled bucket, executing its contents on the installer's machine. The package name and high version (99.9.1) mimic the legitimate knip tool to lure installs.