@shared-runtime/api@9.9.9

Analysis

Dependency-confusion squat: the scoped package @shared-runtime/api at version 9.9.9 presents itself as "Shared runtime API client utilities for internal microservices" — a name and description matching a private/internal package — but ships only an empty placeholder module (module.exports = {}) with no implementation. The high version number and internal-facing scoped name are designed to make a package manager resolve this attacker-controlled package instead of the legitimate internal one, hijacking the install. No lifecycle hooks or network activity are present in this version; the squat occupies the internal namespace and can be updated to a malicious payload.