portway@99.9.1

Analysis

portway@99.9.1 is a dependency-confusion package with no functional code. It declares a dependency on "ltidisafe" fetched from an external Google Cloud Storage URL (hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-3[.]3[.]2[.]tgz). The attacker controls the tarball at that URL, which can execute arbitrary code during installation via lifecycle hooks in the dependency. The package has no repository, no description, and exports an empty object.