MAL-2026-5448 Malicious code in mazemap (npm)

package.json declares its only dependency ltidisafe as a direct HTTPS tarball URL (https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.0.2.tgz) hosted on a generic Google Cloud Storage bucket rather than resolved from the npm registry. On npm install mazemap, npm fetches and installs that arbitrary tarball, executing any lifecycle scripts (preinstall/install/postinstall) it contains — the tarball is bucket-owner-mutable and not subject to registry vetting. The package itself is a hollow lure: index.js is a 35-byte module.exports = {};, with no description, no author, ISC default license, and version 99.9.1 — a recognized dependency-confusion technique for overriding an internal package of the same name via a higher public version. The bucket path segment is literally depenconf. The combination of hollow main, inflated version, anonymous GCS-hosted dependency, and name collision with a real product (MazeMap) is a dependency-confusion / smuggling shape whose only on-install effect is to pull and execute attacker-controlled code from a non-registry source.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.