depcruise-fmt (npm) · Malicious Code

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (08675f5d3de6c71d05588ae719204e2919ffac836aaada2f24b2b61bed2291ba) depcruise-fmt ships an empty module (index.js exports {}) and declares its only dependency, ltidisafe, as an arbitrary HTTPS tarball hosted at https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.7.3.tgz rather than a registry package. On npm install, npm fetches and installs that off-registry tarball into the dependency tree and executes any lifecycle scripts it contains. The wrapper package has no other functionality — its sole effect is to inject the externally hosted payload. The tarball is served from an author-controlled Google Cloud Storage bucket, is not subject to registry publish scanning, is not integrity-pinned, and its contents can be replaced at any time without a corresponding npm publish. The package name also resembles the popular dependency-cruiser tooling, positioning this as a lookalike lure whose only installation effect is to resolve to the GCS-hosted tarball. ## Source: ossf-package-analysis (ea193e6cea73a06c8f92a684d56040564d6a0fef93da1d45010978107ea0fd0c) The OpenSSF Package Analysis project identified 'depcruise-fmt' @ 99.9.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

• npmjs.com/package/depcruise-fmt/v/99.9.1 (opens in a new tab)
• github.com/advisories/GHSA-gh2x-96f9-2cgf (opens in a new tab)