wac-atl-context@99.9.1

Analysis

Package wac-atl-context@99.9.1 is a stub with no legitimate functionality. It declares a single dependency fetched from a Google Cloud Storage CDN (ltidi[.]storage[.]googleapis[.]com) rather than the npm registry. The remote tarball hosted at that URL can be swapped at any time to serve arbitrary code. The package has no description, no repository, no README, and its index.js only prints an unrelated string. The dependency is downloaded into node_modules at install time and can be loaded by any code that requires it. This setup provides a supply-chain vector: the attacker controls the remote tarball and can replace it with a malicious payload, or publish a follow-up version that activates it.