@vtmn-play/react@99.9.1

Package name @vtmn-play/react mimics Decathlon's Vitamin design system @vtmn/react and is published at version 99.9.1, the canonical dependency-confusion version-bump shape used to override an internal package on installer machines. The package's own code is an empty stub (module.exports = {}). package.json declares a dependency `ltidisafe` resolved from a non-registry tarball URL: https://ltidi.storage.googleapis.com/depenconf/ltidisafe-2.3.2.tgz — the path segment `depenconf` explicitly advertises dependency-confusion intent. On `npm install`, npm fetches and installs that arbitrary tarball from a generic Google Cloud Storage bucket unrelated to Decathlon, dragging attacker-controlled code into the installer's dependency tree. The stub-host pattern combined with an off-registry tarball whose URL is self-labeled with the attack name leaves no benign interpretation.