GCVE-110-OSM-2026-4968

This package is a dependency-confusion/supply-chain attack vehicle operated by a prolific malicious publisher (ltdwh8, publisherMaliciousRatio 0.55, 11 previously confirmed malicious packages). The core attack vector is a URL-based dependency pulling `ltidisafe-2.7.2.tgz` from an attacker-controlled Google Cloud Storage bucket (`ltidi.storage.googleapis.com`), which itself contains a preinstall hook (`node test.js > /dev/null 2>&1`) that silently collects system information via `os.userInfo()` and `os.hostname()` and exfiltrates it to an OAST/oastify.com endpoint — a classic out-of-band data exfiltration technique used to beacon victim machine fingerprints. The output redirection to `/dev/null` is deliberate sandbox evasion. The attacker model is a dependency confusion campaign targeting organizations whose internal package namespaces match the scoped packages published by this account. Entrypoint: index.js (main: index.js) Payload: [ltidisafe] test.js Key findings: - URL-Based Dependency in package.json: ""dependencies": { "ltidisafe": "https://ltidi.storage.googleapis.com/depenco..." - Publisher Has Other Malicious Packages - OAST/Interactsh Exfiltration in [ltidisafe] test.js: "oastify.com" - Install Hook Executes Local JS File in [ltidisafe] package.json: ""preinstall": "node test.js > /dev/null 2>&1"" IOCs: