commonweb-card@99.9.1

Analysis

A cluster of empty packages (commonweb-moneymovement, commonweb-wallet, commonweb-balance, commonweb-card) all at version 99.9.1, each containing only a stub index.js that exports an empty object. The sole purpose of each package is to declare a dependency on an external tarball hosted at ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-*.tgz. When npm installs the package, it fetches and installs the external tarball, which the attacker controls and can swap at any time to deliver arbitrary code into the install chain. The package names combosquat financial terminology to trick developers into installing them.