GCVE-110-OSM-2026-5922

This package uses a URL-based dependency pointing to an external GCS bucket (ltidisafe-3.0.7.tgz from ltidi.storage.googleapis.com) to side-load a malicious payload that executes at preinstall time via 'node test.js > /dev/null 2>&1' — the redirect to /dev/null is a classic stealth technique to hide execution output. The bundled ltidisafe package contacts an oastify.com OAST endpoint, which is exclusively used for out-of-band exfiltration confirmation, and collects system information via os.userInfo() and os.hostname() for environment fingerprinting. The publisher 'whltd3' has a publisherMaliciousRatio of 0.33 with 4 confirmed malicious packages already in OSM, establishing a clear pattern of supply-chain attack infrastructure. The attacker model is a dependency-confusion or typosquatting supply chain attack that delivers a stager through an externally-hosted tarball. ENTRY index.js (main: index.js) - URL-Based Dependency in package.json: ""dependencies": { "ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/l..." - Install Hook Executes Local JS File in [ltidisafe] package.json: ""preinstall": "node test.js > /dev/null 2>&1"" EXFIL - OAST/Interactsh Exfiltration in [ltidisafe] test.js: "oastify.com" - Network Request in [ltidisafe] index.js: "http.request(" - System Information Collection in [ltidisafe] test.js: "os.userInfo()" - Suspicious Domain in [ltidisafe] test.js: "oastify.com" ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages PAYLOAD FILES [ltidisafe] test.js