in-install @99.9.1

Summary

in-install@99.9.1 declares its ltidisafe dependency as an HTTPS tarball URL hosted on a Google Cloud Storage bucket ( https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.6.9.tgz ) rather than a registry-resolved package. Running npm install in-install fetches that tarball and installs it into the installer's node_modules, executing whatever install/import-time code it ships. The bucket path is mutable by whoever controls it, is not subject to npm registry review, and is not pinned to a registry-audited artifact, so the bytes delivered at install time can be changed at any moment without a version bump. The package's own index.js is an empty export; the sole observable effect of installing it is pulling arbitrary off-registry code into the installer's environment.

Source: amazon-inspector (58b0bedeac5b8460ad12e0ef3e013f8146eb2b7adacd483c3b8833f1dcbb457b)