Malicious code in connect-contingency (npm)

connect-contingency@99.9.1 was published to npm as a malicious package designed to execute attacker-controlled code on installation. The package itself is a hollow stub with an empty index.js file.\n\nThe attack mechanism relies on a direct tarball dependency declared in package.json pointing to https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.4.7.tgz on an anonymous Google Cloud Storage bucket. When npm install is executed, this tarball is downloaded from the external, non-registry host and installed, bypassing npm's integrity and audit mechanisms.\n\nThe package exhibits classic dependency-confusion staging characteristics: an inflated 99.9.x version number, an empty main module, and a suspicious external URL path (/depenconf/). The sole purpose of the package is to pull attacker-controlled code into the installer's environment via lifecycle scripts (preinstall/install/postinstall) declared in the malicious tarball.\n\nThe incident was identified and credited to the OpenSSF malicious-packages project.