depcruise-baseline@99.9.1

Analysis

depcruise-baseline@99.9.1 is an empty stub package (index.js exports an empty object, no install scripts) that declares a single dependency, ltidisafe, resolved from a non-registry Google Cloud Storage URL (hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-3[.]7[.]4[.]tgz) instead of the npm registry. Installing the package fetches and executes a tarball from this attacker-controlled host, delivering a remote payload outside the normal registry supply chain.