MAL-2026-13440

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (b3a03c555705f2bfa2e63b96e9ea5740196d1ea5ca8be0f1acce290c771f01ea) connect-contingency@99.9.1 is a hollow package whose index.js is an empty stub. Its package.json declares its sole dependency `ltidisafe` as a direct tarball URL on an anonymous Google Cloud Storage bucket: `https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.4.7.tgz`. On `npm install`, npm downloads that tarball from a non-registry, non-publisher host outside registry integrity/audit coverage and installs it, executing any lifecycle scripts (preinstall/install/postinstall) it declares. The package name, an inflated 99.9.x version characteristic of dependency-confusion staging, the empty main, and the `/depenconf/` URL path together indicate a dependency-confusion lure whose only effect on install is to pull attacker-controlled code into the installer's environment.