metrics-ui @99.9.1

Summary

metrics-ui is a functionally empty npm package (hollow index.js, no scripts) whose only effect on installers is pulling in a runtime dependency resolved from a hardcoded off-registry URL. package.json declares dependencies.ltidisafe = "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.4.4.tgz", causing npm to fetch and install that tarball's contents into node_modules on every npm install metrics-ui . The tarball is served from a Google Cloud Storage bucket path controlled by whoever owns the bucket, bypassing npm registry publication, scanning, and immutability guarantees; the bucket contents can be swapped at any time and any lifecycle hooks or top-level require() side effects in the fetched package then run in the installer's environment. The package name resembles common analytics/UI naming while shipping no actual UI or metrics code, consistent with a dropper-lure shape whose sole purpose is to force-resolve attacker-controlled code into consumers' dependency graphs.

Source: amazon-inspector (40a5f1c46b3dedff62a0fbbb97026f6ad0b4c59cbbfb5f3078de824328c09b8c)