GCVE-110-OSM-2026-14376

package.json declares its sole dependency `ltidisafe` as a direct HTTPS tarball URL (https://storage.googleapis.com/lscunpentest/pack_ux_foundry.tgz) instead of a registry version range. On `npm install`, npm fetches whatever bytes are currently at that URL and installs them into the dependency tree, running any lifecycle scripts the fetched tarball contains, with no version pin and no integrity hash. Whoever controls the bucket controls code that executes on the installer's machine, and the bytes can change at any time without any change to this package. The shipped source is a one-line stub, so the manifest line is the entire published surface of the package. The bucket path segment `lscunpentest` is also consistent with penetration-testing / unauthorized-testing framing. ENTRY index.js (main: index.js) - URL-Based Dependency in package.json: ""dependencies": { "ltidisafe": "https://storage.googleapis.com/lscunpentest/pack..." - Install Hook Executes Local JS File in [ltidisafe] package/package.json: ""preinstall": "node test.js > /dev/null 2>&1"" EXFIL - OAST/Interactsh Exfiltration in [ltidisafe] package/test.js: "oastify.com" - Network Request in [ltidisafe] package/index.js: "http.request(" - System Information Collection in [ltidisafe] package/test.js: "os.hostname()" - Suspicious Domain in [ltidisafe] package/test.js: "oastify.com" OBFUSCATION - recovered 2 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Rapid Version Publishing PAYLOAD FILES [ltidisafe] package/test.js