{"id":"MAL-2026-18289","summary":"Malicious code in paychex-pdftron (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d32ec8b2ca67156d94943a27b9b7c98f1888d530d7a6f947e49b40f52ec054b3)\npaychex-pdftron@99.9.1 ships an empty stub (module.exports = {}) and declares its sole dependency `ltidisafe` as a bare HTTPS tarball URL (https://ltidi.storage.googleapis.com/depenconf/ltidisafe-4.0.5.tgz) rather than a registry version range. On `npm install`, npm fetches whatever bytes that URL returns and installs the resulting package, executing any lifecycle scripts it contains — with no version pin, no integrity hash, and no signature verification. The package name resembles an internal Paychex scope, the version is an implausibly high `99.9.1` (a dependency-confusion resolution tactic), the URL path segment is `depenconf`, and the host is unrelated to any legitimate Paychex or pdftron domain. The manifest alone is the attack surface: resolving this dependency pulls attacker-controlled code into the installer's build environment.\n","modified":"2026-10-25T15:30:04.535294404Z","published":"2026-10-25T14:42:30Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["99.9.1"],"id":"IN-MAL-2026-021684","import_time":"2026-10-25T15:15:13.530209881Z","modified_time":"2026-10-25T14:42:30Z","sha256":"d32ec8b2ca67156d94943a27b9b7c98f1888d530d7a6f947e49b40f52ec054b3"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/paychex-pdftron/v/99.9.1"}],"affected":[{"package":{"name":"paychex-pdftron","ecosystem":"npm","purl":"pkg:npm/paychex-pdftron"},"versions":["99.9.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"tlsh":"63e0c2204aa266334ec611b6892a665bf3728e9f4808bc1c6edb041c519db7329f925c","path":"package.json","sha256":"c38000f81b723958cac533ddaaf7ccb7ea3b61fd3e3505914f41728fe225b544"}],"package_integrity":[{"hashes":{"sha512_sri":"sha512-pZqtLBeukEMcPQYRNsGX0eL0FCMhzWxe22Pwl7El3L57A0FhPbQwBECc/Z+6GNj+uvAicj9IEsJqpUkxcC58GA==","sha1":"e20aaebe8e0b1cfe01b6afcaa7738c56f5022170"},"filename":"paychex-pdftron-99.9.1.tgz"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/paychex-pdftron/MAL-2026-18289.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}