GCVE-110-OSM-2026-4961

This package implements a classic supply-chain attack via a URL-based dependency (`ltidisafe` fetched from `ltidi.storage.googleapis.com/depenconf/ltidisafe-2.7.6.tgz`) that is not registered in npm and therefore bypasses registry security scanning. The fetched dependency contains a preinstall hook (`node test.js > /dev/null 2>&1`) that silently collects system information via `os.userInfo()` and `os.hostname()` and exfiltrates it to an OAST endpoint (`oastify.com`), a known out-of-band data collection service used in malicious packages. The publisher `ltdwh8` has a malicious ratio of 0.55 across 20 checked packages (11 confirmed malicious), indicating a deliberate prolific campaign — likely dependency confusion or typosquatting across multiple corporate namespaces. The attacker model is recon/exfiltration on install: collect environment fingerprint and beacon to attacker-controlled infrastructure. Entrypoint: index.js (main: index.js) Payload: [ltidisafe] test.js Key findings: - URL-Based Dependency in package.json: ""dependencies": { "ltidisafe": "https://ltidi.storage.googleapis.com/depenco..." - Publisher Has Other Malicious Packages - OAST/Interactsh Exfiltration in [ltidisafe] test.js: "oastify.com" - Install Hook Executes Local JS File in [ltidisafe] package.json: ""preinstall": "node test.js > /dev/null 2>&1"" IOCs: