[email protected] is a malicious npm package that exports an empty module but installs a runtime dependency 'ltidisafe' from an arbitrary external tarball URL hosted on a Google Cloud Storage bucket unrelated to any known dependency-cruiser publisher. During npm install, the tarball is downloaded and installed, and any lifecycle scripts inside it execute on the installer's machine. Because the tarball is hosted externally and can be swapped without republishing the npm package, this bypasses registry scanning and version pinning protections. The package name and versioning are crafted to resemble an internal helper of dependency-cruiser, consistent with a dependency-confusion or smuggling attack vector.

Installation of this package results in execution of arbitrary code from an external source controlled by the bucket owner, potentially leading to compromise of the installer's environment. The ability to swap the tarball contents at any time without npm republishing means that malicious payloads can be delivered dynamically, evading standard supply chain protections.

No official patch or fix is indicated. Users should avoid installing [email protected]. Verify dependencies carefully to avoid dependency confusion attacks. Use tools that detect hollow or suspicious packages and avoid packages that fetch runtime dependencies from untrusted external URLs. Monitor package sources and prefer packages from verified publishers.