ltididp1@1.0.4

Analysis

ltididp1@1.0.4 is a 338-byte stub with no lifecycle hook whose only real content is an external dependency on ltidisafe fetched from hxxps://ltidi.storage.googleapis[.]com/ltidisafe-1.0.1.tgz, an attacker-controlled host. On install, npm attempts a GET to that URL to retrieve a second-stage tarball, which would have delivered the malicious payload.