gunzip-js@99.9.1

Analysis

gunzip-js@99.9.1 is an empty stub package (index.js exports an empty object) that declares a dependency "ltidisafe" fetched at install time from an off-registry Google Cloud Storage CDN: hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-3[.]7[.]2[.]tgz. The dependency tarball is attacker-controlled and is downloaded and installed from the CDN rather than the npm registry, giving the publisher arbitrary code execution on the installer's machine during install.