app-data-lts @2.1.6

Summary

package.json declares postinstall node test.js and main: index.js , but index.js is absent from the tarball. test.js executes require('.') , which throws immediately because the main module is missing, so the postinstall hook fails. README describes an unrelated 'ts-api' project, author metadata is empty, and dependencies include a package named child_process that name-squats the Node.js core module. No exfiltration, remote fetch, credential access, or executable payload is present in the shipped files. The shape is consistent with either a broken publish, a placeholder, or a staged release awaiting a payload in a future version, but as shipped the package has no code path that harms an installer.

Source: amazon-inspector (2f9d67601ec8b46265e1f23f5e48ff5beb050626f4bc156b291cb1b8f8c36d35)