The npm package sso-users-detection version 99.9.1 is identified as a hollow package with no legitimate content. Its installation causes npm to fetch and install a runtime dependency named ltdisafe from a third-party Google Cloud Storage bucket, bypassing npm registry scanning. This behavior is consistent with a dependency confusion attack designed to smuggle attacker-controlled code into the dependency tree.