Malicious code in @factoryz/apollo (npm)

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (5adaa62818c76a10cbf0b536a6854633e24a73028c803fc597c5b5ec1d78b8ad) The package ships only an empty stub (`module.exports = {}`) and a manifest whose sole dependency `ltidisafe` is resolved from a hardcoded off-registry HTTPS URL (`https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.7.tgz`) rather than a registry version range. `npm install @factoryz/apollo` fetches whatever bytes that URL returns and installs them, executing any lifecycle scripts (preinstall/install/postinstall) contained in the fetched tarball. There is no version pin, no integrity (`sshasum`) check, and no publisher binding — the host controller can swap the tarball contents at any time. The version number `99.9.1` is implausibly high for a package whose shipped code is a one-line stub, consistent with a dependency-confusion / resolution-winning shape. The lure package itself contains no other logic; the manifest IS the payload.

Source published

25 Oct 2026 15:05:42 UTC

Source modified

25 Oct 2026 15:30:05 UTC

Observed here

25 Oct 2026 16:17:16 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.