@cr-invested-ui-components/chart@99.9.1

Analysis

Dependency-confusion package @cr-invested-ui-components/chart@99.9.1 impersonates a UI component library via a scoped name and version-squat (99.9.1) to outrank legitimate internal packages. The package is an empty stub with no real functionality (module.exports = {}). It declares a dependency on an external non-registry tarball at hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-3[.]4[.]2[.]tgz, which delivers arbitrary code from a CDN when the dependency is resolved during install. The package has no repository, no description, and no README.