{"id":"MAL-2026-18064","revision":"1c8c5f381bd0417ebf793447e4164c64","records":[{"revision":"1c8c5f381bd0417ebf793447e4164c64","observedAt":"2026-10-25T16:17:16.268+00:00","statement":{"source":"osv","id":"MAL-2026-18064","aliases":[],"title":"Malicious code in sc-announcer (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2a03b9445f383410d981355df7ba577b7834a37d226e05852b4a0b9c7d998d9c)\nsc-announcer@99.9.1 ships an empty stub (`module.exports = {}`) and declares a single dependency `ltidisafe` sourced from an off-registry HTTPS tarball URL (`https://ltidi.storage.googleapis.com/depenconf/ltidisafe-4.0.2.tgz`) in package.json rather than a registry version range. On `npm install`, npm fetches that tarball and installs whatever bytes it returns, with no version pin, no integrity hash, and no registry provenance; any lifecycle scripts contained inside the fetched tarball execute on the installer's machine. The implausibly high version number (99.9.1) and dependency-confusion-shaped setup — stub package whose only effect is to pull a URL-sourced dependency — are consistent with a resolution-hijack lure targeting an internal package name.\n\n## Source: ossf-package-analysis (38abcbba47f18b6d76a06a770258c620fc322472d0db0d38b67f04805b916d43)\nThe OpenSSF Package Analysis project identified 'sc-announcer' @ 99.9.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","state":0,"publishedAt":"2026-10-20T04:11:06+00:00","modifiedAt":"2026-10-25T15:30:06.6232491+00:00","affected":[{"ecosystem":"npm","name":"sc-announcer","ranges":[],"versions":["99.9.1"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/sc-announcer/v/99.9.1"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-18064","license":"OSV · upstream source license applies","key":"osv:MAL-2026-18064","identifiers":["MAL-2026-18064"]},"retained":false,"historicalAffected":[]}],"coverage":[]}