The [email protected] npm package is a dependency confusion attack vector. Instead of resolving dependencies from the official npm registry, it references a tarball hosted on a Google Cloud Storage bucket (ltidi.storage.googleapis.com) that is not linked to any verified npm publisher identity. The tarball is not pinned by hash, allowing the attacker to change its contents at will. When npm installs this package, it fetches and installs the malicious tarball, executing any lifecycle scripts contained therein. This results in arbitrary code execution in the environment of the user installing the package. The package itself contains no functional code other than metadata and the dependency entry, consistent with a dependency confusion stub.

An attacker controlling the referenced Google Cloud Storage bucket can execute arbitrary code on any system that installs [email protected]. This occurs through lifecycle scripts in the malicious tarball fetched during npm install. The attack enables full code execution in the installer's environment without requiring direct compromise of the npm registry or the victim's system prior to installation.

No official patch or fix is currently available for [email protected]. Users should avoid installing this package version. Since the malicious code is delivered via an external tarball outside the npm registry, verifying package integrity by avoiding untrusted dependencies and using package lockfiles or hash pinning is recommended. Monitor vendor advisories for updates or official remediation. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.