{"schema_version":"1.9.0","id":"MAL-2026-18061","published":"2026-10-20T03:43:48Z","modified":"2026-10-25T15:30:05.531550313Z","summary":"Malicious code in ccl-global-shopping (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4f380c5b8a8363f9bdd4b9466bdbbeaed301ef5fe0facf7f64eb3296848f9f96)\npackage.json declares its sole dependency `ltidisafe` as a direct HTTPS tarball URL (https://ltidi.storage.googleapis.com/depenconf/ltidisafe-4.0.4.tgz) instead of a registry version range. On `npm install`, npm fetches whatever bytes that URL currently serves and runs any lifecycle scripts inside the fetched package, with no version pin and no integrity hash — the bucket owner controls the code executed on every installer's machine, and the content can be swapped at any time. The package's own shipped index.js is an empty stub (`module.exports = {};`), so the manifest URL is effectively the entire payload surface. The package name resembles a shopping/retail library, giving it the shape of a dependency-confusion or typosquat lure whose only install-time effect is to pull in attacker-controlled code from an off-registry location.\n\n## Source: ossf-package-analysis (31f39d40e2c7700b1c070cbd26ea533789dc444daaf58e77d191f7eb10036fc9)\nThe OpenSSF Package Analysis project identified 'ccl-global-shopping' @ 99.9.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"name":"ccl-global-shopping","ecosystem":"npm","purl":"pkg:npm/ccl-global-shopping"},"versions":["99.9.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"e9e98693d0c9eb37a93dde98907d5c9e94dcae09b3c5de09440c6767de68155a","tlsh":"7fe02c200a3066330eca00b68c2a644bf3b08e4f5408bc0c1aaf081c809cbb328f926c"}],"package_integrity":[{"filename":"ccl-global-shopping-99.9.1.tgz","hashes":{"sha1":"337940ed8320220f0cdcb5e0feaaf061d083bde0","sha512_sri":"sha512-CWS7TwlA6qj4Tr8KPmhvBycykZVVt9M+VaQAwKZy6Bdl3OMZvu0iC3aZTyUYOfR7X326o1fjKnRvcjMLhjj+2Q=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/ccl-global-shopping/MAL-2026-18061.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/ccl-global-shopping/v/99.9.1"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-10-20T03:47:10.606218958Z","modified_time":"2026-10-20T03:43:48Z","sha256":"31f39d40e2c7700b1c070cbd26ea533789dc444daaf58e77d191f7eb10036fc9","source":"ossf-package-analysis","versions":["99.9.1"]},{"id":"IN-MAL-2026-021688","import_time":"2026-10-25T15:15:13.933229557Z","modified_time":"2026-10-25T15:05:06Z","sha256":"4f380c5b8a8363f9bdd4b9466bdbbeaed301ef5fe0facf7f64eb3296848f9f96","source":"amazon-inspector","versions":["99.9.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}