rc-icon@99.9.1

Analysis

Package rc-icon@99.9.1 is a dependency-confusion vehicle. Its only purpose is to pull an unvetted external dependency into the installer's build pipeline: it declares a dependency on "ltidisafe" hosted at an external Google Cloud Storage URL rather than from the npm registry. The package body is a 26-byte stub (console.log("ltidifromh1")) with no functional value, and the version 99.9.1 is set absurdly high to hijack semver resolution over any legitimate rc-icon version. Installing this package causes the installer's npm to fetch and execute code from an attacker-controlled GCS bucket, enabling arbitrary code execution in the build environment — a supply-chain initial-access attack.