depcruise-fmt@99.9.1

Analysis

depcruise-fmt@99.9.1 is a stub package (its only code is `module.exports = {}`) that declares a single dependency, `ltidisafe`, fetched at install time from a non-registry Google Cloud Storage CDN URL (hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-3[.]7[.]3[.]tgz). The package name impersonates the dependency-cruiser tool's CLI. Installing this package pulls and installs the remote tarball from the attacker-controlled CDN rather than from the npm registry, delivering the payload as a dependency.