commonweb-wallet@99.9.1

Analysis

Package commonweb-wallet@99.9.1 is a dependency-confusion attack. It ships a 35-byte stub (index.js = "module.exports = {}") with no real functionality. Its only dependency is a remote tarball URL (hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-3[.]5[.]1[.]tgz) hosted on a Google Cloud Storage bucket controlled by the attacker. Installing the package fetches attacker-controlled code from outside the npm registry; the attacker can replace the tarball contents at any time to serve arbitrary code to all installers.