oem-agentic-shared@99.9.1

Analysis

This package is an empty placeholder whose only purpose is to act as a dependency-confusion vehicle. It publishes an inflated version (99.9.1) of an internal-sounding name so that it wins version resolution over a legitimate same-named internal package. Its package.json declares a single dependency that is fetched not from the npm registry but from an external HTTPS tarball hosted on Google Cloud Storage (the URL path is named after dependency confusion). On install, npm downloads and unpacks that external, attacker-controlled tarball, delivering the actual payload while the published package itself contains only an empty module.