Malicious code in sc-announcer (npm)

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2a03b9445f383410d981355df7ba577b7834a37d226e05852b4a0b9c7d998d9c) [email protected] ships an empty stub (`module.exports = {}`) and declares a single dependency `ltidisafe` sourced from an off-registry HTTPS tarball URL (`https://ltidi.storage.googleapis.com/depenconf/ltidisafe-4.0.2.tgz`) in package.json rather than a registry version range. On `npm install`, npm fetches that tarball and installs whatever bytes it returns, with no version pin, no integrity hash, and no registry provenance; any lifecycle scripts contained inside the fetched tarball execute on the installer's machine. The implausibly high version number (99.9.1) and dependency-confusion-shaped setup — stub package whose only effect is to pull a URL-sourced dependency — are consistent with a resolution-hijack lure targeting an internal package name. ## Source: ossf-package-analysis (38abcbba47f18b6d76a06a770258c620fc322472d0db0d38b67f04805b916d43) The OpenSSF Package Analysis project identified 'sc-announcer' @ 99.9.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

Source published

20 Oct 2026 04:11:06 UTC

Source modified

25 Oct 2026 15:30:06 UTC

Observed here

25 Oct 2026 16:17:16 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.