in-install@99.9.1

Analysis

in-install@99.9.1 is an empty package (index.js exports an empty object, no code, no lifecycle hooks) whose only dependency, ltidisafe, is fetched at install time from a non-registry Google Cloud Storage URL: hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-3[.]6[.]9[.]tgz. The dependency is not published on the npm registry, so its tarball contents are unverifiable and controlled by the package author. Installing this package pulls and installs an arbitrary, unverifiable tarball from an external CDN host.