higherlogic-ocfe@99.9.1

Analysis

Package higherlogic-ocfe@99.9.1 is a dependency-confusion package that delivers a remote payload. The package itself is an empty stub, but its package.json declares a dependency on "ltidisafe" hosted at an external Google Storage URL (hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-3[.]1[.]4[.]tgz). When installed, npm fetches this attacker-controlled tarball, which can execute arbitrary code during its own install lifecycle hooks. The high version number (99.9.1) on a first publish is characteristic of dependency-confusion attacks targeting internal package names.