process-status-widget@99.9.1

Analysis

Package process-status-widget@99.9.1 is a dependency-confusion package with no functional code (empty index.js). It declares a single dependency fetched from an external, attacker-controlled URL: hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-3[.]4[.]1[.]tgz. The package was published at version 99.9.1 with no prior versions, and the external tarball is installed by npm during dependency resolution, allowing the attacker to serve arbitrary malicious code at any time.