cxpw-offers@99.9.1

Analysis

Dependency-confusion package. cxpw-offers@99.9.1 is a minimal stub (empty index.js) that declares a single dependency resolved from an external URL: hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-3[.]4[.]9[.]tgz. The high version number on a generic name is designed to take priority over a private internal package with the same name. The remote tarball is attacker-controlled and can deliver arbitrary code on install.