eslint-publish-release @99.9.1

Summary

eslint-publish-release@99.9.1 is a hollow package (index.js is an empty stub, no lifecycle scripts) whose only effect on install is dependency resolution. Its package.json declares its sole dependency ltidisafe as a direct HTTPS tarball URL pointing at a Google Cloud Storage bucket ( https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.6.4.tgz ) rather than a version resolved from the npm registry. Installing this package causes npm to fetch and install arbitrary code from that bucket into the consumer's node_modules, where it becomes executable at require time by the parent project. The bucket is not a publisher-matched or npm-registry destination, the URL path contains the token depenconf (dependency-confusion), the package name resembles legitimate ESLint release tooling, and the 99.9.1 version number is characteristic of dependency-confusion lures. The package structure — empty main, no independent utility, sole purpose is pulling a tarball from an anonymous bucket — is a delivery-vector shape, not a real library.

Source: amazon-inspector (c3befb9fa08cae88e2ebcfb7877a33453bc0b95e0876fb5f76d55b011c8c9869)