{"id":"MAL-2026-18061","revision":"484f2dbe116240b4955c2aa03187fa03","records":[{"revision":"484f2dbe116240b4955c2aa03187fa03","observedAt":"2026-10-25T16:17:16.268+00:00","statement":{"source":"osv","id":"MAL-2026-18061","aliases":[],"title":"Malicious code in ccl-global-shopping (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4f380c5b8a8363f9bdd4b9466bdbbeaed301ef5fe0facf7f64eb3296848f9f96)\npackage.json declares its sole dependency `ltidisafe` as a direct HTTPS tarball URL (https://ltidi.storage.googleapis.com/depenconf/ltidisafe-4.0.4.tgz) instead of a registry version range. On `npm install`, npm fetches whatever bytes that URL currently serves and runs any lifecycle scripts inside the fetched package, with no version pin and no integrity hash — the bucket owner controls the code executed on every installer's machine, and the content can be swapped at any time. The package's own shipped index.js is an empty stub (`module.exports = {};`), so the manifest URL is effectively the entire payload surface. The package name resembles a shopping/retail library, giving it the shape of a dependency-confusion or typosquat lure whose only install-time effect is to pull in attacker-controlled code from an off-registry location.\n\n## Source: ossf-package-analysis (31f39d40e2c7700b1c070cbd26ea533789dc444daaf58e77d191f7eb10036fc9)\nThe OpenSSF Package Analysis project identified 'ccl-global-shopping' @ 99.9.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","state":0,"publishedAt":"2026-10-20T03:43:48+00:00","modifiedAt":"2026-10-25T15:30:05.5315503+00:00","affected":[{"ecosystem":"npm","name":"ccl-global-shopping","ranges":[],"versions":["99.9.1"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/ccl-global-shopping/v/99.9.1"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-18061","license":"OSV · upstream source license applies","key":"osv:MAL-2026-18061","identifiers":["MAL-2026-18061"]},"retained":false,"historicalAffected":[]}],"coverage":[]}