{"id":"MAL-2026-13987","summary":"Malicious code in resolve-audit (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (86b902b4dc4c2187bb95548ed903dfea70ea626ba5450f031c2cb27b3639dd1c)\nresolve-audit@99.9.1 is a stub package (index exports an empty object) whose package.json declares its only dependency `ltidisafe` as a direct HTTPS tarball URL: https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.6.6.tgz. On `npm install`, npm fetches this arbitrary tarball from an anonymous, mutable Google Cloud Storage bucket (path segment `depenconf`, a dependency-confusion marker) rather than resolving through the npm registry, with no version-by-hash pinning. Any lifecycle scripts inside that tarball execute on the installer. The version number 99.9.1 is characteristic of dependency-confusion/version-squat lures designed to win resolution against a private-registry package of the same name.\n","modified":"2026-08-13T21:30:27.255573455Z","published":"2026-08-13T21:07:30Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["99.9.1"],"id":"IN-MAL-2026-017677","import_time":"2026-08-13T21:20:57.144582362Z","modified_time":"2026-08-13T21:07:30Z","sha256":"86b902b4dc4c2187bb95548ed903dfea70ea626ba5450f031c2cb27b3639dd1c"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/resolve-audit/v/99.9.1"}],"affected":[{"package":{"name":"resolve-audit","ecosystem":"npm","purl":"pkg:npm/resolve-audit"},"versions":["99.9.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/resolve-audit/MAL-2026-13987.json","cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"3ace4f75307d1cce8d400ee056e3fd3bace9c4d6cdbf54cbe8ec69371475e56f","tlsh":"2ce0c2304a6566334fd551b28c2b655bf7b18e5f0808bc0c5aeb582c818ebb328f939d"}],"package_integrity":[{"hashes":{"sha1":"7c17395ac3a70bf3da5e6aed1f9b8453865f12b1","sha512_sri":"sha512-U7O97coRwu7t053XsNyMtAn93DyxanjlQRCdnb64Q84qtJC5Kj3glwwuKXyJuar96IRCYfG0YLkDrWFybXXB0A=="},"filename":"resolve-audit-99.9.1.tgz"}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}