depcruise-fmt @99.9.1

Summary

depcruise-fmt ships an empty module (index.js exports {}) and declares its only dependency, ltidisafe, as an arbitrary HTTPS tarball hosted at https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.7.3.tgz rather than a registry package. On npm install, npm fetches and installs that off-registry tarball into the dependency tree and executes any lifecycle scripts it contains. The wrapper package has no other functionality — its sole effect is to inject the externally hosted payload. The tarball is served from an author-controlled Google Cloud Storage bucket, is not subject to registry publish scanning, is not integrity-pinned, and its contents can be replaced at any time without a corresponding npm publish. The package name also resembles the popular dependency-cruiser tooling, positioning this as a lookalike lure whose only installation effect is to resolve to the GCS-hosted tarball.

Source: amazon-inspector (08675f5d3de6c71d05588ae719204e2919ffac836aaada2f24b2b61bed2291ba)