GCVE-110-OSM-2026-4963

This package is a dependency-confusion/supply-chain attack vehicle operated by a prolific malicious publisher (ltdwh8, publisherMaliciousRatio 0.55, 11 previously flagged packages). The real payload is delivered via an external URL-based dependency 'ltidisafe' fetched from a Google Cloud Storage bucket (ltidi.storage.googleapis.com/depenconf/ltidisafe-2.8.2.tgz), completely bypassing registry security. That bundled package runs a preinstall hook 'node test.js > /dev/null 2>&1' that collects system information via os.userInfo()/os.hostname() and exfiltrates it to an OAST endpoint at oastify.com — a classic out-of-band callback used to confirm successful compromise. The attacker model is a dependency confusion or typosquatting campaign using throwaway packages (version 99.9.1, no description, no repo, single version, brand new) to beacon victim environments. Entrypoint: index.js (main: index.js) Payload: [ltidisafe] test.js Key findings: - URL-Based Dependency in package.json: ""dependencies": { "ltidisafe": "https://ltidi.storage.googleapis.com/depenco..." - Publisher Has Other Malicious Packages - OAST/Interactsh Exfiltration in [ltidisafe] test.js: "oastify.com" - Brand New Package - Install Hook Executes Local JS File in [ltidisafe] package.json: ""preinstall": "node test.js > /dev/null 2>&1"" IOCs: