commonweb-rewards@99.9.1

Analysis

Dependency-confusion packages published at version 99.9.1 with names impersonating internal enterprise modules (commonweb-rewards, consumerweb-creditcollection, commonweb-moneymovement, cxpw-offers, requestor-util). Each package contains an empty index.js and declares a single dependency pointing to an external tarball hosted at ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-*.tgz. When installed, npm fetches and extracts the external tarball, which delivers the actual payload. The external tarball URLs are: hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-3[.]5[.]5[.]tgz, hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-3[.]5[.]3[.]tgz, hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-3[.]5[.]4[.]tgz, hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-3[.]4[.]9[.]tgz, hxxps://ltidi[.]storage[.]googleapis[.]com/depenconf/ltidisafe-3[.]4[.]6[.]tgz.