{"schema_version":"1.9.0","id":"MAL-2026-18064","published":"2026-10-20T04:11:06Z","modified":"2026-10-25T15:30:06.623249053Z","summary":"Malicious code in sc-announcer (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2a03b9445f383410d981355df7ba577b7834a37d226e05852b4a0b9c7d998d9c)\nsc-announcer@99.9.1 ships an empty stub (`module.exports = {}`) and declares a single dependency `ltidisafe` sourced from an off-registry HTTPS tarball URL (`https://ltidi.storage.googleapis.com/depenconf/ltidisafe-4.0.2.tgz`) in package.json rather than a registry version range. On `npm install`, npm fetches that tarball and installs whatever bytes it returns, with no version pin, no integrity hash, and no registry provenance; any lifecycle scripts contained inside the fetched tarball execute on the installer's machine. The implausibly high version number (99.9.1) and dependency-confusion-shaped setup — stub package whose only effect is to pull a URL-sourced dependency — are consistent with a resolution-hijack lure targeting an internal package name.\n\n## Source: ossf-package-analysis (38abcbba47f18b6d76a06a770258c620fc322472d0db0d38b67f04805b916d43)\nThe OpenSSF Package Analysis project identified 'sc-announcer' @ 99.9.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"name":"sc-announcer","ecosystem":"npm","purl":"pkg:npm/sc-announcer"},"versions":["99.9.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"0b322ad667691334037655744c9ec981821ed538cf766bb5e7cd8d5a9046a571","tlsh":"32e072200a2066330eca01b6886b640bf3708e4f0808bc0c5adf041c418cb7338fa39d"}],"package_integrity":[{"filename":"sc-announcer-99.9.1.tgz","hashes":{"sha1":"08706d84e21ec70c597ec33fa26f49bb5eaf3672","sha512_sri":"sha512-Z7IIvgiGbZ/BEcrc0tHsBADuEgJ2VYjlmcTRXA1sUG1T4o6RjCsTDIqbb9sMTQBO0Iie9tFd7jNxALuwHAUqUA=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sc-announcer/MAL-2026-18064.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/sc-announcer/v/99.9.1"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-10-20T04:20:16.26283185Z","modified_time":"2026-10-20T04:11:06Z","sha256":"38abcbba47f18b6d76a06a770258c620fc322472d0db0d38b67f04805b916d43","source":"ossf-package-analysis","versions":["99.9.1"]},{"id":"IN-MAL-2026-021690","import_time":"2026-10-25T15:15:14.091480282Z","modified_time":"2026-10-25T15:05:21Z","sha256":"2a03b9445f383410d981355df7ba577b7834a37d226e05852b4a0b9c7d998d9c","source":"amazon-inspector","versions":["99.9.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}