The sso-users-detection package at version 99.9.1 is a malicious npm package that acts as a dependency confusion lure. It contains no meaningful exports or metadata and uses an inflated version number. Upon installation, it pulls a runtime dependency (ltidisafe) from a raw tarball hosted on a third-party Google Cloud Storage bucket rather than the official npm registry. This external tarball and its lifecycle scripts are fully controlled by the attacker, allowing arbitrary code execution during installation. The package's design bypasses npm registry scanning, increasing the risk of unnoticed malicious code execution in projects that include it.

If installed, this package causes npm to execute attacker-controlled code from an external source during the installation process. This can lead to arbitrary code execution on the developer's machine or build environment, potentially compromising the system or the software supply chain. The malicious package does not appear to have known exploits in the wild at this time.

No official patch or fix is available for this package. The best mitigation is to avoid installing sso-users-detection version 99.9.1 and audit dependencies for suspicious or hollow packages. Since the malicious code is hosted outside the npm registry, reliance on npm registry scanning alone is insufficient. Developers should verify package provenance and avoid dependencies with empty metadata and unusual versioning. Monitoring for updates or advisories from npm or security vendors is recommended.