polylabel-web-lib@99.9.1

Analysis

polylabel-web-lib is a combosquat of the legitimate polylabel package. The package contains no functional code (index.js exports an empty object). Its sole dependency, ltidisafe, is declared via a direct HTTPS URL (hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-3[.]2[.]2[.]tgz) rather than the npm registry. Installing this package causes npm to download and install the external tarball, which can deliver arbitrary code at install time. The package has no repository, no description, and no stated purpose.