eslint-generate-prerelease

Package ships an empty module (index.js = 'module.exports = {};') under a name that resembles internal tooling, published at an inflated version 99.9.1 — the canonical shape used to win version resolution against a private-registry package of the same name. Its single dependency, 'ltidisafe', is declared not as a registry package but as a direct tarball URL on a Google Cloud Storage bucket (https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.6.2.tgz). On `npm install`, npm fetches that tarball from a location the registry does not audit and executes any lifecycle scripts and main module it contains. The path segment 'depenconf' and the version-inflation pattern are consistent with a targeted dependency-confusion attack. The lure package itself is hollow; the harm arrives through the URL-pinned transitive dependency.