via-city-tools-m-particle @99.9.1

Summary

The package exports an empty object ( module.exports = {} ) and has no functionality of its own. Its only substantive effect is to declare a dependency on ltidisafe pinned to the off-registry tarball URL https://ltidi.storage.googleapis.com/depenconf/ltidisafe-2.7.6.tgz . Installing this package causes npm to fetch and install that arbitrary tarball — hosted in a generic Google Cloud Storage bucket with no registry integrity guarantees and no publisher binding — and any lifecycle scripts ( preinstall / install / postinstall ) inside it run automatically on the installer's machine. The package metadata is hollow (empty description , empty author , no repository ), and the unscoped name via-city-tools-m-particle resembles legitimate scoped tooling, consistent with a dependency-confusion lure whose only purpose is to smuggle the off-registry tarball into target build environments.

Source: amazon-inspector (bc5c4f690e0399edc4408e7729291803db7916ed764bcfe16988f4cdccd5cfc1)