commonweb-wallet@99.9.1

Summary

commonweb-wallet@99.9.1 is an empty wrapper (index.js is module.exports = {}; package.json has empty author/description and an implausible 99.9.1 version) whose sole dependency ltidisafe is declared as a direct HTTPS tarball URL pointing at a Google Cloud Storage bucket (https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.5.1.tgz) unrelated to any known npm publisher. On npm install, npm downloads and installs that off-registry tarball into the installer's node_modules and executes its lifecycle hooks and require()-time code. The bucket contents are mutable, unpinned by hash, and not subject to npm registry integrity or provenance checks, so whatever bytes are served at install time run on the installer's machine. The wrapper contributes no functionality of its own; its only effect is to smuggle attacker-controlled code into the dependency tree of anyone installing this wallet-named package.

Source: amazon-inspector (a1769ac1af054b70eedc630a2cda97a2d810ef7c8551a7e80b2f859f0c578d33)