The 'portway' npm package version 99.9.1 includes a dependency 'ltidisafe' specified as a direct HTTPS tarball URL hosted on a generic Google Cloud Storage bucket. This dependency is not sourced from the official npm registry, lacks integrity pinning, and is mutable by whoever controls the storage bucket. As a result, the package bypasses npm registry security reviews and scanners. Although 'ltidisafe' ships an empty index.js and no lifecycle scripts, its code can run if required by the application, posing a risk of executing malicious code from an untrusted source.

This supply chain vulnerability allows an attacker controlling the Google Cloud Storage bucket to modify the 'ltidisafe' package contents at any time, potentially injecting malicious code that will be executed in environments installing 'portway' version 99.9.1. This undermines the trust and security guarantees normally provided by the npm registry and can lead to arbitrary code execution in dependent projects.

No official patch or fix is currently documented. Users should avoid installing 'portway' version 99.9.1 until the dependency on the off-registry 'ltidisafe' tarball is removed or replaced with a trusted, registry-hosted package. Monitor vendor advisories for updates or official remediation. Consider auditing dependencies for off-registry URLs and avoid packages that fetch mutable code from untrusted sources.