MAL-2026-10419 Malicious code in notifications-broadcast (npm)

[email protected] ships an empty index.js (module.exports = {};) with placeholder metadata (empty description, empty author, version 99.9.1 consistent with a dependency-confusion stub). Its only functional content is a dependency entry that resolves ltidisafe to a tarball URL at https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.3.4.tgz rather than the npm registry. The Google Cloud Storage bucket ltidi.storage.googleapis.com is not tied to a verifiable npm publisher identity, the tarball is not pinned by hash, and the bucket path segment depenconf matches the dependency-confusion attack shape. On npm install, npm fetches this tarball and installs its contents into the installer's node_modules, executing any lifecycle scripts and making its code reachable via require(). Whoever controls the GCS bucket therefore obtains code execution in the installer's environment via the transitive dependency, and the bucket contents can be mutated at any time without any change to this package.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.