firefly-utilities-helper@99.9.1

Analysis

firefly-utilities-helper is a dependency-confusion carrier package. The package itself is an empty shell (index.js exports {}, ~359 bytes, no lifecycle hooks), but its only dependency is an off-registry HTTPS tarball at hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-3[.]0[.]6[.]tgz. At npm install time that attacker-controlled tarball is fetched and extracted; if it carries lifecycle hooks, arbitrary code executes. The package has zero functionality and exists solely to route the installer into an attacker-controlled archive.