notifications-broadcast@99.9.1

Analysis

Dependency-confusion attack: notifications-broadcast@99.9.1 is an empty package (index.js exports an empty object) that declares a single dependency hosted on an external URL rather than the npm registry. On install, npm fetches the dependency tarball from hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-3[.]3[.]4[.]tgz — an attacker-controlled Google Cloud Storage bucket that can serve arbitrary malicious code. The high version (99.9.1) is a dependency-confusion outranking tactic designed to be installed in place of a legitimate internal package with the same name.