@fmr-ap153177/apex-kit-icons@99.9.1

Analysis

This package is a dependency-confusion carrier: @fmr-ap153177/apex-kit-icons@99.9.1 is a near-empty stub (index.js exports an empty object) published at sentinel version 99.9.1 whose only functional content is a dependency on a raw off-registry tarball, "ltidisafe": "hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-3[.]9[.]1[.]tgz". Installing the package fetches and installs that tarball from the attacker-controlled Google Cloud Storage bucket instead of the npm registry, bypassing registry review and integrity tracking. The same bucket path (/depenconf/) and the same 99.9.1 sentinel version are used by sibling scoped stubs @fmr-ap149494/apex-base-component@99.9.1 (ltidisafe-3.8.9.tgz) and @fcsmc/commercial-analytics@99.9.1 (ltidisafe-3.8.8.tgz), each shipping a different payload version. The stub itself contains no executable code and no lifecycle hooks; the payload is the externally hosted tarball.