{"id":"MAL-2026-18064","kind":"package","aliases":["MAL-2026-18064"],"related":[],"title":"Malicious code in sc-announcer (npm)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (2a03b9445f383410d981355df7ba577b7834a37d226e05852b4a0b9c7d998d9c)\nsc-announcer@99.9.1 ships an empty stub (`module.exports = {}`) and declares a single dependency `ltidisafe` sourced from an off-registry HTTPS tarball URL (`https://ltidi.storage.googleapis.com/depenconf/ltidisafe-4.0.2.tgz`) in package.json rather than a registry version range. On `npm install`, npm fetches that tarball and installs whatever bytes it returns, with no version pin, no integrity hash, and no registry provenance; any lifecycle scripts contained inside the fetched tarball execute on the installer's machine. The implausibly high version number (99.9.1) and dependency-confusion-shaped setup — stub package whose only effect is to pull a URL-sourced dependency — are consistent with a resolution-hijack lure targeting an internal package name.\n\n## Source: ossf-package-analysis (38abcbba47f18b6d76a06a770258c620fc322472d0db0d38b67f04805b916d43)\nThe OpenSSF Package Analysis project identified 'sc-announcer' @ 99.9.1 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"sc-announcer","fixed":[],"affected":"= 99.9.1","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-20T04:11:06+00:00","first_seen_at":"2026-10-26T20:51:52+00:00","triaged_at":"2026-10-26T21:02:03+00:00","updated_at":"2026-10-26T21:05:48+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-18064':10A,13A '-2026':9A,12A '/depenconf/ltidisafe-4.0.2.tgz':59C '2a03b9445f383410d981355df7ba577b7834a37d226e05852b4a0b9c7d998d9c':32C '38abcbba47f18b6d76a06a770258c620fc322472d0db0d38b67f04805b916d43':149C '99.9.1':36C,111C,159C 'activ':177C 'amazon':30C 'amazon-inspector':29C 'analysi':148C,153C 'announc':6A,35C,158C 'announcer':16A 'associ':174C 'byte':78C 'code':2A 'communic':170C 'confus':115C 'consid':165C 'consist':132C 'contain':95C 'declar':43C 'depend':46C,114C,130C 'dependency-confusion-shap':113C 'detail':21C 'domain':173C 'edit':24C 'effect':122C 'empti':39C 'execut':100C 'fetch':72C,98C 'hash':87C 'high':108C 'hijack':137C 'https':54C 'identifi':155C 'implaus':107C 'insid':96C 'inspector':31C 'instal':70C,76C,103C 'integr':86C 'intern':141C 'lifecycl':93C 'line':27C 'ltidi.storage.googleapis.com':58C 'ltidi.storage.googleapis.com/depenconf/ltidisafe-4.0.2.tgz':57C 'ltidisaf':47C 'lure':138C 'machin':105C 'mal':8A,11A 'malici':1A,17B,162C,166C,176C 'module.exports':41C 'name':143C 'npm':7A,69C,71C,160C 'number':110C 'off-registri':51C 'openssf':151C 'ossf':146C 'ossf-package-analysi':145C 'packag':18B,119C,142C,147C,152C,169C 'package.json':61C 'per':19C 'pin':84C 'project':154C 'proven':91C 'pull':125C 'rang':67C 'rather':62C 'registri':53C,65C,90C 'resolut':136C 'resolution-hijack':135C 'return':80C 'sc':5A,15A,34C,157C 'sc-announc':4A,33C,156C 'sc-announcer':14A 'script':94C 'setup':117C 'shape':116C 'ship':37C 'singl':45C 'sourc':20C,28C,48C,129C,144C 'stub':40C,118C 'tarbal':55C,74C,99C 'target':139C 'url':56C,128C 'url-sourc':127C 'version':66C,83C,109C 'whatev':77C 'whose':120C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T04:11:06+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18064","url":"https://osv.dev/vulnerability/MAL-2026-18064","severity":"critical","published_at":"2026-10-20T04:11:06+00:00","modified_at":"2026-10-25T15:30:06+00:00","first_seen_at":"2026-10-26T20:51:52+00:00","fetched_at":"2026-10-26T20:51:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}