{"id":"MAL-2026-18289","revision":"3a8a170c4e5344f4aa4ba172604cbfce","records":[{"revision":"3a8a170c4e5344f4aa4ba172604cbfce","observedAt":"2026-10-25T16:17:16.268+00:00","statement":{"source":"osv","id":"MAL-2026-18289","aliases":[],"title":"Malicious code in paychex-pdftron (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d32ec8b2ca67156d94943a27b9b7c98f1888d530d7a6f947e49b40f52ec054b3)\npaychex-pdftron@99.9.1 ships an empty stub (module.exports = {}) and declares its sole dependency `ltidisafe` as a bare HTTPS tarball URL (https://ltidi.storage.googleapis.com/depenconf/ltidisafe-4.0.5.tgz) rather than a registry version range. On `npm install`, npm fetches whatever bytes that URL returns and installs the resulting package, executing any lifecycle scripts it contains — with no version pin, no integrity hash, and no signature verification. The package name resembles an internal Paychex scope, the version is an implausibly high `99.9.1` (a dependency-confusion resolution tactic), the URL path segment is `depenconf`, and the host is unrelated to any legitimate Paychex or pdftron domain. The manifest alone is the attack surface: resolving this dependency pulls attacker-controlled code into the installer's build environment.\n","state":0,"publishedAt":"2026-10-25T14:42:30+00:00","modifiedAt":"2026-10-25T15:30:04.5352944+00:00","affected":[{"ecosystem":"npm","name":"paychex-pdftron","ranges":[],"versions":["99.9.1"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/paychex-pdftron/v/99.9.1"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-18289","license":"OSV · upstream source license applies","key":"osv:MAL-2026-18289","identifiers":["MAL-2026-18289"]},"retained":false,"historicalAffected":[]}],"coverage":[]}