depcruise-wrap-stream-in-html@99.9.1

Analysis

The package is an empty shell (index.js exports an empty object) that declares a dependency named "ltidisafe" fetched at install time from a non-registry Google Cloud Storage URL (hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-3[.]7[.]5[.]tgz). The package name is a combosquat of the legitimate dependency-cruiser tool, and the off-registry dependency is pulled from a CDN path under "depenconf", indicating a dependency-confusion supply-chain attack where the real payload is delivered via the external dependency rather than the package's own code.