GCVE-110-OSM-2026-4969

This package employs a dependency-confusion / supply-chain attack pattern: it pulls a URL-based dependency (`ltidisafe`) from a Google Cloud Storage bucket (`ltidi.storage.googleapis.com/depenconf/ltidisafe-2.7.3.tgz`) that contains the actual payload, bypassing npm registry security entirely. The embedded `ltidisafe` package runs `node test.js > /dev/null 2>&1` at preinstall time, where `test.js` collects system information via `os.userInfo()` and `os.hostname()` and exfiltrates it to an OAST/oastify.com endpoint — a well-known attacker-controlled out-of-band exfiltration service. The publisher `ltdwh8` (email: `test+8@mymydirtyhobby.com`) has a malicious ratio of 0.55 across 20 checked packages, with 11 already confirmed malicious in OSM, establishing a clear pattern of dependency-confusion campaigning. The output suppression (`> /dev/null 2>&1`) and hostname fingerprinting are consistent with sandbox-evasion and silent beacon-on-install attacker tradecraft. Entrypoint: index.js (main: index.js) Payload: [ltidisafe] test.js Key findings: - URL-Based Dependency in package.json: ""dependencies": { "ltidisafe": "https://ltidi.storage.googleapis.com/depenco..." - Publisher Has Other Malicious Packages - OAST/Interactsh Exfiltration in [ltidisafe] test.js: "oastify.com" - Install Hook Executes Local JS File in [ltidisafe] package.json: ""preinstall": "node test.js > /dev/null 2>&1"" IOCs: