GCVE-110-OSM-2026-4970

This is a dependency confusion / supply chain attack. The package pulls a URL-based dependency `ltidisafe` from a Google Cloud Storage bucket (ltidi.storage.googleapis.com), which contains a preinstall hook running `node test.js > /dev/null 2>&1` silently on install. That `test.js` collects system information via `os.userInfo()` and `os.hostname()` and exfiltrates it to an oastify.com OAST endpoint — a classic install-time beaconing pattern used to confirm victim identity. The publisher `ltdwh8` has a 55% malicious ratio across 20 checked packages (11 confirmed malicious), indicating a prolific dependency confusion campaign operator targeting private namespace packages across multiple organizations (Citi, Deel, Cloudways, etc.). Entrypoint: index.js (main: index.js) Payload: [ltidisafe] test.js Key findings: - URL-Based Dependency in package.json: ""dependencies": { "ltidisafe": "https://ltidi.storage.googleapis.com/depenco..." - Publisher Has Other Malicious Packages - OAST/Interactsh Exfiltration in [ltidisafe] test.js: "oastify.com" - Install Hook Executes Local JS File in [ltidisafe] package.json: ""preinstall": "node test.js > /dev/null 2>&1"" IOCs: