ccl-global-shopping@99.9.1

Analysis

ccl-global-shopping@99.9.1 is an empty placeholder package (index.js contains only `module.exports = {}`) whose sole purpose is to pull a remote payload at install time. Its package.json declares a single dependency, "ltidisafe", as a raw tarball URL rather than a registry version: hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-4[.]0[.]4[.]tgz. Installing the package causes npm to download and unpack that tarball from an off-registry Google Cloud Storage bucket, so the code that actually runs comes from an attacker-controlled host and bypasses the npm registry's integrity and audit trail. The URL path segment "depenconf" and the 99.9.1 version number indicate a dependency-confusion delivery mechanism: a high-version placeholder published under a name that a private or internal registry might resolve, with the real payload staged in the external tarball. The package ships no lifecycle hooks and no executable code of its own; the entire risk is the external dependency URL.