frontend-regulations@99.9.1

Analysis

Dependency-confusion attack: the package is a stub (empty index.js, no repository, no description) published at version 99.9.1 with a single dependency that resolves to an external tarball URL (hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-3[.]3[.]3[.]tgz). The name mimics an internal/enterprise package. At install time npm fetches and executes the attacker-controlled tarball from the GCS bucket, which can contain arbitrary code.