{"id":"MAL-2026-13982","summary":"Malicious code in in-install (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (58b0bedeac5b8460ad12e0ef3e013f8146eb2b7adacd483c3b8833f1dcbb457b)\nin-install@99.9.1 declares its `ltidisafe` dependency as an HTTPS tarball URL hosted on a Google Cloud Storage bucket (`https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.6.9.tgz`) rather than a registry-resolved package. Running `npm install in-install` fetches that tarball and installs it into the installer's node_modules, executing whatever install/import-time code it ships. The bucket path is mutable by whoever controls it, is not subject to npm registry review, and is not pinned to a registry-audited artifact, so the bytes delivered at install time can be changed at any moment without a version bump. The package's own index.js is an empty export; the sole observable effect of installing it is pulling arbitrary off-registry code into the installer's environment.\n","modified":"2026-08-13T21:30:21.351151691Z","published":"2026-08-13T21:08:25Z","database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-017684","import_time":"2026-08-13T21:20:57.372386771Z","modified_time":"2026-08-13T21:08:25Z","sha256":"58b0bedeac5b8460ad12e0ef3e013f8146eb2b7adacd483c3b8833f1dcbb457b","source":"amazon-inspector","versions":["99.9.1"]}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/in-install/v/99.9.1"}],"affected":[{"package":{"name":"in-install","ecosystem":"npm","purl":"pkg:npm/in-install"},"versions":["99.9.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/in-install/MAL-2026-13982.json","cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"sha256":"8cca182a6da64f5125c0aeb31207907da8e98a6853d1f480f1064c7dc5d46b4c","tlsh":"5ae0c2204a6666335ec512b2886b655bf3718e6f1408bc0c5bdb442c419eb7338fa39d","path":"package.json"}],"package_integrity":[{"filename":"in-install-99.9.1.tgz","hashes":{"sha1":"689eea76b0d7306c6a90fc51d2838db41a858044","sha512_sri":"sha512-EGzuWs0bg92bFpXjGYtYK1TfSI4YPBvO5G8qv1tHJl++tlur667/NJr3G/pCHdw75ZpU0satRuKuefV3AVhgJw=="}}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}