GCVE-110-OSM-2026-13304

package.json declares a dependency `ltidisafe` whose source is an off-registry tarball URL (`https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.1.tgz`) rather than a semver range on the npm registry. The shipped `index.js` is an empty stub (`module.exports = {}`), so the manifest URL is the entire install-time surface. On `npm install`, npm fetches whatever bytes that URL returns — unpinned, no integrity hash, no registry publisher check — installs the resulting package, and runs any lifecycle scripts inside it. Whoever controls that bucket path controls code execution on the installer's machine. ENTRY index.js (main: index.js) - URL-Based Dependency in package.json: ""dependencies": { "ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/l..." - Install Hook Executes Local JS File in [ltidisafe] package.json: ""preinstall": "node test.js > /dev/null 2>&1"" EXFIL - OAST/Interactsh Exfiltration in [ltidisafe] test.js: "oastify.com" - Network Request in [ltidisafe] index.js: "http.request(" - System Information Collection in [ltidisafe] test.js: "os.userInfo()" - Suspicious Domain in [ltidisafe] test.js: "oastify.com" OBFUSCATION - recovered 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Very New NPM Publisher Account - Publisher Has Other Malicious Packages - Rapid Version Publishing PAYLOAD FILES [ltidisafe] test.js