GCVE-110-OSM-2026-4965

This package implements a classic dependency confusion / supply chain attack vector. The package.json pulls in a URL-based dependency ('ltidisafe') hosted on an attacker-controlled Google Cloud Storage bucket (ltidi.storage.googleapis.com), bypassing registry integrity checks entirely. That fetched dependency contains a preinstall hook ('node test.js > /dev/null 2>&1') that silently collects system information via os.userInfo() and os.hostname() and exfiltrates it to an OAST/Interactsh endpoint (oastify.com), with output suppressed to avoid detection. The publisher 'ltdwh8' has a malicious ratio of 0.55 across 20 checked packages, with 11 already confirmed malicious in OSM — this is a prolific threat actor running a dependency confusion campaign targeting enterprise namespaces (@cseo-hr, @deel-core, @citi-icg-171632, @cloudways-lab, etc.). The attacker model is consistent with credential/environment harvesting via OAST beacon on install. Entrypoint: index.js (main: index.js) Payload: [ltidisafe] test.js Key findings: - URL-Based Dependency in package.json: ""dependencies": { "ltidisafe": "https://ltidi.storage.googleapis.com/depenco..." - Publisher Has Other Malicious Packages - OAST/Interactsh Exfiltration in [ltidisafe] test.js: "oastify.com" - Install Hook Executes Local JS File in [ltidisafe] package.json: ""preinstall": "node test.js > /dev/null 2>&1"" IOCs: