sc-announcer@99.9.1

Analysis

sc-announcer@99.9.1 is a dependency-confusion carrier: the package contains only an empty stub (index.js exports `{}`) and its package.json declares a single dependency, `ltidisafe`, pinned to a raw off-registry tarball at hxxps://ltidi[.]storage.googleapis[.]com/depenconf/ltidisafe-4.0.2[.]tgz. Installing the package causes npm to fetch and execute code from that attacker-controlled Google Cloud Storage bucket instead of the npm registry, bypassing registry review and audit. The package carries the inflated version 99.9.1 typical of dependency-confusion attacks and has no lifecycle hooks or functional code of its own — the manifest is the payload. The same bucket path is used by the related publish fanarena-common@99.9.1 (ltidisafe-3.9.8.tgz).