@mp-op-ss-front-lib/tracks@99.9.1

Analysis

Dependency-confusion stub at version 99.9.1 on a scoped name. The package is an empty module (module.exports = {}) with no description, repository, or lifecycle scripts. Its only purpose is declaring a dependency on `ltidisafe` from the external URL `hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-3[.]4[.]3[.]tgz` — a Google Cloud Storage bucket, not the npm registry. When installed, npm fetches and installs the attacker-controlled tarball from that URL.