The npm package tivo-codelib-a version 99.9.1 is a malicious package that acts as a hollow lure. It contains an empty stub but declares a runtime dependency on an attacker-controlled tarball hosted on a Google Cloud Storage bucket outside the official npm registry. This external dependency can be swapped at any time to deliver arbitrary malicious code during installation. Systems with this package installed should be considered fully compromised, and all secrets and keys on those systems should be rotated immediately. Removal of the package alone may not fully remediate the compromise.