[email protected] is a malicious npm package that ships an empty index.js and declares a runtime dependency on a tarball hosted outside the npm registry (https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.2.2.tgz). When installed, npm fetches and executes lifecycle scripts from this out-of-registry tarball, allowing the bucket owner to run arbitrary code on the installer's machine. This technique is a form of dependency smuggling used to deliver install-time payloads, with no legitimate functionality in the package itself.

Installation of [email protected] results in execution of arbitrary code controlled by the owner of the external tarball URL during npm install. This can lead to compromise of the install environment, including potential unauthorized access, data theft, or further malware deployment. The malicious payload is not part of the npm registry and can be changed at any time by the bucket owner, increasing risk.

No official patch or fix is currently available for [email protected]. Users should avoid installing this package version. Since the malicious code is delivered via an out-of-registry tarball, verifying package sources and dependencies before installation is critical. Consider removing or replacing this package and auditing your dependency tree for similar out-of-registry dependencies. Monitor vendor advisories for any updates or official remediation.