@postex/common@99.9.1

Analysis

Dependency-confusion probe published as four scoped packages at the sentinel version 99.9.1: @jm-telefonica/multibrand-components, @postex/common, @futurae-public/adaptive-js and @generic-means/ing-feat-scanner-libs. Each has an empty description, no repository, no lifecycle scripts, and a 35-byte index.js whose entire content is `module.exports = {}`. Each declares one dependency, `ltidisafe`, resolved from a raw tarball URL outside the npm registry on a Google Cloud Storage bucket: hxxps://ltidi[.]storage.googleapis[.]com/depenconf/ltidisafe-3.9.2.tgz, hxxps://ltidi[.]storage.googleapis[.]com/depenconf/ltidisafe-3.9.4.tgz and hxxps://ltidi[.]storage.googleapis[.]com/depenconf/ltidisafe-3.9.5.tgz. Installing any of these packages therefore fetches and installs an externally hosted tarball that bypasses registry audit and provenance, and runs whatever install scripts that tarball carries. The bucket path segment "depenconf" indicates the dependency-confusion intent; the targeted scopes are those of real organizations, so a build resolving these names from the public registry at 99.9.1 would pull the external payload.