ing-feat-itsme-oidc-authentication@99.9.1

Analysis

This package is a dependency-confusion implant. It ships no code of its own — index.js is an empty stub (`module.exports = {}`) — and its only dependency, ltidisafe, is resolved to an off-registry tarball at hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-3.9.9[.]tgz. Installing the package therefore downloads and executes attacker-controlled code from a Google Cloud Storage bucket rather than from the npm registry, bypassing registry integrity and takedown controls. The package is published as version 99.9.1 and its name impersonates an internal ING feature package (ing-feat-itsme-oidc-authentication), so it wins version resolution against the internal package it is imitating; the bucket path "depenconf" matches the dependency-confusion technique. The second-stage payload is the external tarball, not part of this package.