requestor-util@99.9.1

Analysis

Dependency-confusion package requestor-util@99.9.1 is a hollow module (empty index.js, no description, no repository) that declares a single dependency fetched from an attacker-controlled Google Cloud Storage URL (hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-3[.]4[.]6[.]tgz). At install time, npm downloads and extracts this remote tarball, enabling arbitrary code execution on the installer's machine. The high version number (99.9.1) and empty package body are characteristic of a dependency-confusion attack targeting internal/private package resolution.