{"id":"MAL-2026-18061","kind":"package","aliases":["MAL-2026-18061"],"related":[],"title":"Malicious code in ccl-global-shopping (npm)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (4f380c5b8a8363f9bdd4b9466bdbbeaed301ef5fe0facf7f64eb3296848f9f96)\npackage.json declares its sole dependency `ltidisafe` as a direct HTTPS tarball URL (https://ltidi.storage.googleapis.com/depenconf/ltidisafe-4.0.4.tgz) instead of a registry version range. On `npm install`, npm fetches whatever bytes that URL currently serves and runs any lifecycle scripts inside the fetched package, with no version pin and no integrity hash — the bucket owner controls the code executed on every installer's machine, and the content can be swapped at any time. The package's own shipped index.js is an empty stub (`module.exports = {};`), so the manifest URL is effectively the entire payload surface. The package name resembles a shopping/retail library, giving it the shape of a dependency-confusion or typosquat lure whose only install-time effect is to pull in attacker-controlled code from an off-registry location.\n\n## Source: ossf-package-analysis (31f39d40e2c7700b1c070cbd26ea533789dc444daaf58e77d191f7eb10036fc9)\nThe OpenSSF Package Analysis project identified 'ccl-global-shopping' @ 99.9.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"ccl-global-shopping","fixed":[],"affected":"= 99.9.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-20T03:43:48+00:00","first_seen_at":"2026-10-26T20:51:52+00:00","triaged_at":"2026-10-26T21:02:03+00:00","updated_at":"2026-10-26T21:05:48+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-18061':11A,14A '-2026':10A,13A '/depenconf/ltidisafe-4.0.4.tgz)':49C '31f39d40e2c7700b1c070cbd26ea533789dc444daaf58e77d191f7eb10036fc9':170C '4f380c5b8a8363f9bdd4b9466bdbbeaed301ef5fe0facf7f64eb3296848f9f96':34C '99.9.1':181C 'activ':199C 'amazon':32C 'amazon-inspector':31C 'analysi':169C,174C 'associ':196C 'attack':156C 'attacker-control':155C 'bucket':85C 'byte':62C 'ccl':5A,16A,178C 'ccl-global-shop':4A,177C 'ccl-global-shopping':15A 'code':2A,89C,158C 'communic':192C 'confus':141C 'consid':187C 'content':98C 'control':87C,157C 'current':65C 'declar':36C 'depend':39C,140C 'dependency-confus':139C 'detail':23C 'direct':43C 'domain':195C 'edit':26C 'effect':121C,150C 'empti':113C 'entir':123C 'everi':92C 'execut':90C 'fetch':60C,74C 'give':133C 'global':6A,17A,179C 'hash':83C 'https':44C 'identifi':176C 'index.js':110C 'insid':72C 'inspector':33C 'instal':58C,93C,148C 'install-tim':147C 'instead':50C 'integr':82C 'librari':132C 'lifecycl':70C 'line':29C 'locat':164C 'ltidi.storage.googleapis.com':48C 'ltidi.storage.googleapis.com/depenconf/ltidisafe-4.0.4.tgz)':47C 'ltidisaf':40C 'lure':144C 'machin':95C 'mal':9A,12A 'malici':1A,19B,184C,188C,198C 'manifest':118C 'module.exports':115C 'name':128C 'npm':8A,57C,59C,182C 'off-registri':161C 'openssf':172C 'ossf':167C 'ossf-package-analysi':166C 'owner':86C 'packag':20B,75C,106C,127C,168C,173C,191C 'package.json':35C 'payload':124C 'per':21C 'pin':79C 'project':175C 'pull':153C 'rang':55C 'registri':53C,163C 'resembl':129C 'run':68C 'script':71C 'serv':66C 'shape':136C 'ship':109C 'shop':7A,180C 'shopping':18A 'shopping/retail':131C 'sole':38C 'sourc':22C,30C,165C 'stub':114C 'surfac':125C 'swap':101C 'tarbal':45C 'time':104C,149C 'typosquat':143C 'url':46C,64C,119C 'version':54C,78C 'whatev':61C 'whose':145C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T03:43:48+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18061","url":"https://osv.dev/vulnerability/MAL-2026-18061","severity":"critical","published_at":"2026-10-20T03:43:48+00:00","modified_at":"2026-10-25T15:30:05+00:00","first_seen_at":"2026-10-26T20:51:52+00:00","fetched_at":"2026-10-26T20:51:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}