sso-users-detection@99.9.1

Analysis

Dependency-confusion package published at version 99.9.1 with no functional code (empty module.exports). The package declares a single dependency, ltidisafe, fetched from a non-registry HTTPS URL (ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-3.3.1.tgz). When installed, npm downloads and extracts this externally-hosted tarball, which may contain arbitrary code. The high version number is characteristic of dependency-confusion attacks targeting internal/private package names.