{"id":"MAL-2026-18434","summary":"Malicious code in hs-framework (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2950f0dff0145db43d5dd123c45c2786c7d42f58e7dec69e0178ca2aa325c478)\npackage.json declares its sole dependency `ltidisafe` as a direct HTTPS tarball URL (https://storage.googleapis.com/lscunpentest/pack_ux_foundry.tgz) instead of a registry version range. On `npm install`, npm fetches whatever bytes are currently at that URL and installs them into the dependency tree, running any lifecycle scripts the fetched tarball contains, with no version pin and no integrity hash. Whoever controls the bucket controls code that executes on the installer's machine, and the bytes can change at any time without any change to this package. The shipped source is a one-line stub, so the manifest line is the entire published surface of the package. The bucket path segment `lscunpentest` is also consistent with penetration-testing / unauthorized-testing framing.\n","modified":"2026-11-01T08:30:04.587654033Z","published":"2026-11-01T08:01:49Z","database_specific":{"malicious-packages-origins":[{"sha256":"2950f0dff0145db43d5dd123c45c2786c7d42f58e7dec69e0178ca2aa325c478","source":"amazon-inspector","versions":["999.9.1"],"id":"IN-MAL-2026-022473","import_time":"2026-11-01T08:14:47.457114337Z","modified_time":"2026-11-01T08:01:56Z"},{"sha256":"e5b7694b77d2d36e84ffb82cbdf486244b673b29d8905ae7226022e58ea3bfb7","source":"amazon-inspector","versions":["999.9.2"],"id":"IN-MAL-2026-022472","import_time":"2026-11-01T08:14:47.376631714Z","modified_time":"2026-11-01T08:01:49Z"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/hs-framework/v/999.9.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/hs-framework/v/999.9.2"}],"affected":[{"package":{"name":"hs-framework","ecosystem":"npm","purl":"pkg:npm/hs-framework"},"versions":["999.9.1","999.9.2"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"package_integrity":[{"filename":"hs-framework-999.9.1.tgz","hashes":{"sha512_sri":"sha512-OVz0tkTtWo/CJKu4pdEa0obo8lVMq7N9/3azkc3S3as/NlatVOfPwrmsFUXL1PaUtdoBYg4foQM4OxuYsEB7vg==","sha1":"3ef9cc7ee109bba63e4e90a790d65e98b9bbb6d0"}}],"evidence_files":[{"path":"package.json","sha256":"bc4a2cf8d126a13321765d41a80def9b93440f070a0c3bb823fd7d3fa3b1eb28","tlsh":"5de0d81c561655330fc551a98c156127e2a45e4b140cbd1917df612c46cdbb37cfd39c"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/hs-framework/MAL-2026-18434.json"}}],"schema_version":"1.9.2","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}