mm-ts-utils-client@99.9.1

Analysis

mm-ts-utils-client is a dependency-confusion supply-chain attack. The package is a bare stub (module.exports = {}; ~35 bytes) whose sole purpose is to pull an external dependency (ltidisafe) from hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-2[.]2[.]9[.]tgz. At install, a DNS resolution and HTTPS GET to that URL were observed before the tarball fetch failed (TAR_BAD_ARCHIVE). The dependency-confusion name/version scheme delivers remote payloads at install time.