The npm package '@generic-means/ing-feat-scanner-libs' version 99.9.1 includes a malicious off-registry dependency 'ltidisafe' fetched from an unpinned HTTPS tarball URL. This dependency is not verified through the npm registry and can be swapped by the storage bucket owner, delivering arbitrary code. Installing this package can lead to full system compromise.