@shared-web/tracking@9.9.9

Analysis

A package published under the scoped name @shared-web/tracking at version 9.9.9 contains only an empty placeholder module (index.js exports an empty object) and a stub README, with no lifecycle hooks, dependencies, or executable code. The high version number on a generic internal-looking scoped name is consistent with dependency-confusion squatting: the package is planted to intercept installs that resolve to an internal/private package of the same name. No payload is present in this version; the squat itself is the supply-chain risk.