The [email protected] npm package is a malicious package that acts as a wrapper exporting an empty object but declares a dependency on 'ltidisafe' fetched from an untrusted Google Cloud Storage URL rather than the official npm registry. This external tarball is downloaded and its lifecycle scripts executed during npm install, enabling the injection of malicious code into the installer's environment. The package's suspiciously high version number and hollow main entry align with known dependency-chain dropper tactics to evade detection and deliver malicious payloads.

Installing [email protected] results in the execution of untrusted code from an external source during the npm install process. This can lead to arbitrary code execution on the developer's machine or build environment, potentially compromising the system or supply chain integrity. The package itself does not provide legitimate functionality and is solely intended to deliver malicious payloads.

No official patch or remediation is currently documented. Users should avoid installing [email protected] and audit their dependency trees for this package. Since the malicious code is delivered via an off-registry tarball, verifying package sources and restricting installation to trusted registries is recommended. Monitor vendor advisories for updates or official fixes. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.