MAL-2026-13981

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (c3befb9fa08cae88e2ebcfb7877a33453bc0b95e0876fb5f76d55b011c8c9869) eslint-publish-release@99.9.1 is a hollow package (index.js is an empty stub, no lifecycle scripts) whose only effect on install is dependency resolution. Its package.json declares its sole dependency `ltidisafe` as a direct HTTPS tarball URL pointing at a Google Cloud Storage bucket (`https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.6.4.tgz`) rather than a version resolved from the npm registry. Installing this package causes npm to fetch and install arbitrary code from that bucket into the consumer's node_modules, where it becomes executable at require time by the parent project. The bucket is not a publisher-matched or npm-registry destination, the URL path contains the token `depenconf` (dependency-confusion), the package name resembles legitimate ESLint release tooling, and the 99.9.1 version number is characteristic of dependency-confusion lures. The package structure — empty main, no independent utility, sole purpose is pulling a tarball from an anonymous bucket — is a delivery-vector shape, not a real library.