{"schema_version":"1.9.0","id":"MAL-2026-18062","published":"2026-10-20T03:31:02Z","modified":"2026-10-25T15:30:04.569290884Z","summary":"Malicious code in sc-wizard (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b6626c24ff3f61de611b5962b6a1b21a5f694dfb32059e31f956875dc9d1db02)\npackage.json declares the package's only dependency `ltidisafe` as a direct HTTPS tarball URL (`https://ltidi.storage.googleapis.com/depenconf/ltidisafe-4.0.1.tgz`) rather than a registry version range. On `npm install`, npm fetches that URL and installs whatever bytes it returns, executing any lifecycle scripts contained in the fetched tarball — unpinned, integrity-unchecked, and outside the npm registry's publish controls. The shipped `index.js` is an empty stub, so the manifest-declared off-registry URL is effectively the entire install-time payload. The dependency source is a mutable third-party storage bucket; whoever controls that URL controls code running on the installer's machine at install time. The high version number (`99.9.1`) relative to a short, generic name is consistent with a dependency-confusion lure intended to win resolution against an internal `sc-wizard` package.\n\n## Source: ossf-package-analysis (54691cc130e614ee031186f7e646c3e6076efad6105a6e9cad68f62aa736516b)\nThe OpenSSF Package Analysis project identified 'sc-wizard' @ 99.9.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"name":"sc-wizard","ecosystem":"npm","purl":"pkg:npm/sc-wizard"},"versions":["99.9.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"14ce270c54ef290194a80e17583c917f679b578b2c9ffd952a558d7138f37c09","tlsh":"75e0c2204a6166334ec615b6886a555bf3718e5f0418bd1c5adf041c418dbb328fa25c"}],"package_integrity":[{"filename":"sc-wizard-99.9.1.tgz","hashes":{"sha1":"461fa7fb489dfcdae3855c37b84fe50470515535","sha512_sri":"sha512-Egdobi2KI4YZbdodkno1GjHD2If5Aki8Ysc1qmjfKHFZU+TWO7APNR6vs7BAqUqzrjSIg8KxI5wXn1Kkj/2yIQ=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sc-wizard/MAL-2026-18062.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/sc-wizard/v/99.9.1"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-10-20T03:47:10.361366361Z","modified_time":"2026-10-20T03:31:02Z","sha256":"54691cc130e614ee031186f7e646c3e6076efad6105a6e9cad68f62aa736516b","source":"ossf-package-analysis","versions":["99.9.1"]},{"id":"IN-MAL-2026-021696","import_time":"2026-10-25T15:15:14.609906356Z","modified_time":"2026-10-25T15:06:25Z","sha256":"b6626c24ff3f61de611b5962b6a1b21a5f694dfb32059e31f956875dc9d1db02","source":"amazon-inspector","versions":["99.9.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}