If this package is installed
Remove it, treat the machine (or CI runner) as compromised, and rotate every secret, token and key it could access — from a different, clean machine.
Details
Source: amazon-inspector (2950f0dff0145db43d5dd123c45c2786c7d42f58e7dec69e0178ca2aa325c478)
package.json declares its sole dependency `ltidisafe` as a direct HTTPS tarball URL (https://storage.googleapis.com/lscunpentest/pack_ux_foundry.tgz) instead of a registry version range. On `npm install`, npm fetches whatever bytes are currently at that URL and installs them into the dependency tree, running any lifecycle scripts the fetched tarball contains, with no version pin and no integrity hash. Whoever controls the bucket controls code that executes on the installer's machine, and the bytes can change at any time without any change to this package. The shipped source is a one-line stub, so the manifest line is the entire published surface of the package. The bucket path segment `lscunpentest` is also consistent with penetration-testing / unauthorized-testing framing.