{"id":"MAL-2026-17772","summary":"Malicious code in liferay-workspace-scripts (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3395e72ef77703732691fce21359206afea7598fb3d1dab29ded4b2e1c7cd28f)\npackage.json declares the sole dependency `ltidisafe` as a bare HTTPS tarball URL (`https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.5.tgz`) instead of a registry version range. On `npm install`, npm fetches that URL and installs whatever bytes it returns, executing any lifecycle scripts inside the fetched package, with no version pin and no integrity hash. The shipped `index.js` is an empty stub, so the manifest is the entire published surface. The package name mirrors Liferay-ecosystem tooling and the version `99.9.1` is implausibly high for a legitimate release, consistent with a dependency-confusion lure designed to win resolution against an internal package name. Whoever controls the Google Cloud Storage bucket controls code executed on every installer's machine at install time.\n","modified":"2026-10-11T14:30:06.701749025Z","published":"2026-10-11T13:58:02Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-10-11T14:18:04.775326085Z","modified_time":"2026-10-11T13:58:02Z","sha256":"3395e72ef77703732691fce21359206afea7598fb3d1dab29ded4b2e1c7cd28f","source":"amazon-inspector","versions":["99.9.1"],"id":"IN-MAL-2026-021428"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/liferay-workspace-scripts/v/99.9.1"}],"affected":[{"package":{"name":"liferay-workspace-scripts","ecosystem":"npm","purl":"pkg:npm/liferay-workspace-scripts"},"versions":["99.9.1"],"database_specific":{"indicators":{"evidence_files":[{"sha256":"22381717dbfa961f43f5700dd5eb1659b02631f552dada37044a11135a4d1046","tlsh":"3ae07d2449206a334ec510b24c2a741bf3704e4f0808bc0c5edb481c84dcb732cfa25c","path":"package.json"}],"package_integrity":[{"filename":"liferay-workspace-scripts-99.9.1.tgz","hashes":{"sha1":"62c78a437e7308415f1fa2c77cb6a8aff7db0f72","sha512_sri":"sha512-dWGzCNFjs4EKA5Vd1xIXeVx4kdZD0awGvicixhPLBSD1SMgk5hFfRnkESESofKErqt7NeHjBjDFdSwaHXrEs2Q=="}}]},"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/liferay-workspace-scripts/MAL-2026-17772.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}