knip-bun @99.9.1

Summary

Package knip-bun typosquats the popular knip linter. The main module is an empty stub ( module.exports = {} ), and package.json declares a dependency ltidisafe pinned to an arbitrary Google Cloud Storage URL ( https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.6.8.tgz ) rather than a package on the npm registry. On npm install , npm downloads and installs the tarball from that bucket into the installer's dependency tree and runs whatever install/lifecycle logic it contains. The bucket is unaffiliated with the knip or bun projects, and the fetched tarball is fully controlled by whoever owns that GCS bucket.

Source: amazon-inspector (3d412258df9a21f510333926a9be29bed8ae6368e549e295c84e187bdc1a3725)