@platform-services/hrm-mfe-core@99.9.1

Analysis

@platform-services/hrm-mfe-core@99.9.1 is a dependency-confusion package: a near-empty stub (a single index.js exporting a `hello()` function) published at the sentinel version 99.9.1 whose only dependency is its own package name, @platform-services/hrm-mfe-core, resolved to an off-registry tarball at hxxps://s3[.]amazonaws[.]com/static[.]puffnetwork[.]com/check-network-2.2.1.tgz. Installing the package therefore fetches and installs an attacker-supplied tarball from that S3 bucket instead of the npm registry, outside the registry's audit trail, and places it under the private scope name the stub impersonates. The stub itself contains no lifecycle hooks and no executable payload; the malicious content is the externally hosted dependency it pulls in. The same publish shape (version 99.9.1, ~350-byte stub, off-registry tarball dependency) appears in sibling packages ing-feat-itsme-oidc-authentication@99.9.1, sc-wizard@99.9.1 and ccl-global-shopping@99.9.1, which point at hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-*.tgz.