sourceflow-tracker: I Has a Bucket — npm fetches its payload from GCS

A 379-byte package whose only load-bearing content is a dependency version string pointing into a Google Cloud Storage bucket — so npm itself downloads and detonates the payload, and the registry never holds a copy to scan.