ltididp1@1.0.0

Analysis

ltididp1@1.0.0 presents a benign 29-byte index.js (it only logs 'Hello, world!'), but its sole dependency, ltidisafe, is pulled from a raw.githubusercontent[.]com URL pinned to an unpinned branch ref (refs/heads/main) with a GHSAT access token embedded in the query string. Because the branch ref is mutable, the publisher can swap the fetched tarball for malicious code at any time, giving them a controllable remote code-execution vector while the inert stub keeps installers from suspecting anything — a delayed-weaponization supply-chain setup.