ryan-pdf-js@99.9.1

Analysis

Package ryan-pdf-js@99.9.1 is a dependency-confusion attack. The package itself contains only an empty code stub (module.exports = {}), but its single dependency resolves to an external tarball hosted at hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-3[.]1[.]1[.]tgz. The high version (99.9.1) and impersonating name ("ryan-pdf-js", suggestive of a corporate/internal package) ensure it wins over any legitimate internal package during dependency resolution. The external tarball is fetched and extracted at install time; if the hosted tarball contains lifecycle scripts (preinstall/postinstall), those scripts execute on the installer's machine during npm install.