MAL-2026-10969 Malicious code in commonweb-wallet (npm)

[email protected] is an empty wrapper (index.js is module.exports = {}; package.json has empty author/description and an implausible 99.9.1 version) whose sole dependency ltidisafe is declared as a direct HTTPS tarball URL pointing at a Google Cloud Storage bucket (https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.5.1.tgz) unrelated to any known npm publisher. On npm install, npm downloads and installs that off-registry tarball into the installer's node_modules and executes its lifecycle hooks and require()-time code. The bucket contents are mutable, unpinned by hash, and not subject to npm registry integrity or provenance checks, so whatever bytes are served at install time run on the installer's machine. The wrapper contributes no functionality of its own; its only effect is to smuggle attacker-controlled code into the dependency tree of anyone installing this wallet-named package.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The OpenSSF Package Analysis project identified 'commonweb-wallet' @ 99.9.1 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.