GCVE-110-OSM-2026-4966

This package uses a dependency confusion / supply chain attack model: it pulls in a URL-based dependency ('ltidisafe') hosted on a Google Cloud Storage bucket (ltidi.storage.googleapis.com/depenconf/ltidisafe-2.6.7.tgz), which itself runs a preinstall hook ('node test.js > /dev/null 2>&1') silently on install. The nested ltidisafe package collects system information via os.userInfo() and os.hostname() and exfiltrates to an oastify.com OAST endpoint — a standard beacon-on-install technique used to confirm successful compromise. The publisher 'ltdwh8' has a 55% malicious package ratio across 20 checked packages (11 confirmed malicious), all following the same pattern, indicating a systematic campaign. The email domain 'mymydirtyhobby.com' and version number '99.9.2' are further hallmarks of dependency confusion attack packages targeting internal scoped package names. Entrypoint: index.js (main: index.js) Payload: [ltidisafe] test.js Key findings: - URL-Based Dependency in package.json: ""dependencies": { "ltidisafe": "https://ltidi.storage.googleapis.com/depenco..." - Publisher Has Other Malicious Packages - OAST/Interactsh Exfiltration in [ltidisafe] test.js: "oastify.com" - Install Hook Executes Local JS File in [ltidisafe] package.json: ""preinstall": "node test.js > /dev/null 2>&1"" IOCs: