GCVE-110-OSM-2026-10519

This package is a supply-chain attack using a URL-based dependency to load a malicious tarball from `ltidi.storage.googleapis.com` that executes on preinstall via `node test.js > /dev/null 2>&1`. The dependency `ltidisafe` collects system information (`os.userInfo()`, `os.hostname()`) and exfiltrates it via DNS to an oastify.com OAST endpoint (`eslint-generate-prerelease.h0i91poi03iihp3rv0wyz10wfnlg96xv.oastify.com`), a classic canary-token exfiltration technique used for environment fingerprinting and victim tracking. The publisher `whltd4` has a 54% malicious package ratio with 13 confirmed malicious packages, indicating a systematic threat actor running a broad campaign of squatted/confusingly-named packages. The output suppression (`> /dev/null 2>&1`) is deliberate anti-detection behavior consistent with adversarial intent. ENTRY index.js (main: index.js) - URL-Based Dependency in package.json: ""dependencies": { "ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/l..." - Install Hook Executes Local JS File in [ltidisafe] package.json: ""preinstall": "node test.js > /dev/null 2>&1"" EXFIL - OAST/Interactsh Exfiltration in [ltidisafe] test.js: "oastify.com" - Network Request in [ltidisafe] index.js: "http.request(" - System Information Collection in [ltidisafe] test.js: "os.userInfo()" - Suspicious Domain in [ltidisafe] test.js: "oastify.com" OBFUSCATION - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages PAYLOAD FILES [ltidisafe] test.js