Malicious code in liferay-workspace-scripts (npm)

The liferay-workspace-scripts package.json specifies a sole dependency 'ltidisafe' via a direct HTTPS tarball URL rather than a versioned registry reference. This URL points to a Google Cloud Storage bucket controlled by an attacker. Because npm installs the package from this URL without integrity checks or version pinning, any lifecycle scripts in the malicious package execute on the installer's machine. The package version 99.9.1 is unusually high, likely to win dependency resolution over legitimate internal packages, indicating a dependency confusion attack vector. The shipped index.js is empty, meaning the manifest itself is the main surface, but the risk lies in the arbitrary code execution during installation.

An attacker controlling the Google Cloud Storage bucket can execute arbitrary code on any machine that installs liferay-workspace-scripts version 99.9.1, potentially leading to full system compromise or further supply chain attacks. This occurs during the npm install process without user awareness due to lack of integrity verification and version pinning.

No official patch or fix is indicated in the provided data. Users should avoid installing liferay-workspace-scripts version 99.9.1 until the dependency on the malicious 'ltidisafe' package is removed or replaced with a secure, versioned registry dependency. Implementing strict dependency integrity checks and avoiding direct URL dependencies without verification can mitigate this risk. Monitor vendor advisories for updates or official fixes.