{"schema_version":"1.9.0","id":"MAL-2026-18278","published":"2026-10-25T15:05:42Z","modified":"2026-10-25T15:30:05.561272205Z","summary":"Malicious code in @factoryz/apollo (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (5adaa62818c76a10cbf0b536a6854633e24a73028c803fc597c5b5ec1d78b8ad)\nThe package ships only an empty stub (`module.exports = {}`) and a manifest whose sole dependency `ltidisafe` is resolved from a hardcoded off-registry HTTPS URL (`https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.7.tgz`) rather than a registry version range. `npm install @factoryz/apollo` fetches whatever bytes that URL returns and installs them, executing any lifecycle scripts (preinstall/install/postinstall) contained in the fetched tarball. There is no version pin, no integrity (`sshasum`) check, and no publisher binding — the host controller can swap the tarball contents at any time. The version number `99.9.1` is implausibly high for a package whose shipped code is a one-line stub, consistent with a dependency-confusion / resolution-winning shape. The lure package itself contains no other logic; the manifest IS the payload.\n","affected":[{"package":{"name":"@factoryz/apollo","ecosystem":"npm","purl":"pkg:npm/%40factoryz/apollo"},"versions":["99.9.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"package.json","sha256":"047a18bdf5444efd58a97b5235c9db62e42494b289c710c66c607c1d65fc166a","tlsh":"27e072300a25aa334eca00f24c2aa00bf3b28e5f4409bc0c2adb042c448cab328f935c"}],"package_integrity":[{"filename":"apollo-99.9.1.tgz","hashes":{"sha1":"5cc1221839062b7ca3263e3855be1f1760b0b9fb","sha512_sri":"sha512-98tlo0q3FT1t5xbDqQiEZ4+V+kU7hLd++biRQjCYQaAMxYsas7Xmtnt5akGv5F++ySkwcU6HX5i53W7xwbgFUA=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@factoryz/apollo/MAL-2026-18278.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@factoryz/apollo/v/99.9.1"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-021693","import_time":"2026-10-25T15:15:14.363350468Z","modified_time":"2026-10-25T15:05:42Z","sha256":"5adaa62818c76a10cbf0b536a6854633e24a73028c803fc597c5b5ec1d78b8ad","source":"amazon-inspector","versions":["99.9.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}