GCVE-110-OSM-2026-10526

Judge assessment: This looks like a deliberate install-time exfiltration package, likely a burner or typo-squat used to fingerprint victims and beacon to attacker-controlled infrastructure. The `preinstall` hook runs `node test.js`, and that file collects `os.userInfo()` and `os.hostname()` before contacting `oastify.com`; the decoded IOC is consistent with out-of-band exfiltration. The URL-based dependency on `https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.7.3.tgz` adds a second remote code-load path, which is especially concerning in combination with the install hook and network activity. The publisher model is also strongly malicious: `whltd4` has a 0.35 malicious ratio with multiple prior reported malicious packages, and the package itself is brand-new with minimal metadata; this is consistent with an attacker using a compromised or throwaway npm account to deliver malware. ENTRY index.js (main: index.js) - URL-Based Dependency in package.json: ""dependencies": { "ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/l..." - Install Hook Executes Local JS File in [ltidisafe] package.json: ""preinstall": "node test.js > /dev/null 2>&1"" EXFIL - OAST/Interactsh Exfiltration in [ltidisafe] test.js: "oastify.com" - Network Request in [ltidisafe] index.js: "http.request(" - System Information Collection in [ltidisafe] test.js: "os.userInfo()" - Suspicious Domain in [ltidisafe] test.js: "oastify.com" OBFUSCATION - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Brand New Package PAYLOAD FILES [ltidisafe] test.js