취약점

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (198750c8e5d6f4d8a3f3f788a2fd9286f43b5a447bb0e3495b50663c44ddd2a7)

Package ui-ng-components@99.9.1 is an empty shell (index.js exports {}, no author, no description, no functionality) with a single dependency declared as a remote tarball URL: https://ltidi.storage.googleapis.com/depenconf/ltidisafe-2.7.9.tgz. The version number 99.9.1 and the literal depenconf segment in the dependency URL are the canonical fingerprint of a dependency-confusion override targeting an internal Angular UI component name. On npm install, npm fetches and installs that opaque tarball as a transitive dependency; any lifecycle scripts inside it run on the installer's machine, and its contents are not reviewable from the registry. The host package ships no library code — its only on-install effect is dropping in this externally-hosted tarball, making the install itself the attack surface.