MalwarePublished 12 Jul 2026Updated 2 Aug 2026

polylabel-web-lib (npm) · Malicious Code

Affects polylabel-web-libSource GCVE Database

Malicious package : remove polylabel-web-lib and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 15:56 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10198

What to do

Remove polylabel-web-lib from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmpolylabel-web-lib	Affected =99.9.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The polylabel-web-lib package version 99.9.1 on npm includes a malicious design where its only runtime dependency is an out-of-registry tarball hosted on a Google Cloud Storage bucket. This tarball can contain arbitrary install-time code controlled by the bucket owner, which executes during npm install. The package itself serves only to smuggle this external dependency into environments, enabling potential execution of malicious payloads at install time.

Impact

Installation of polylabel-web-lib@99.9.1 results in execution of arbitrary code controlled by the owner of the external tarball URL during npm install. This can lead to compromise of the install environment, including potential unauthorized access, data theft, or further malware deployment. The malicious payload is not part of the npm registry and can be changed at any time by the bucket owner, increasing risk.

Defensive guidance

Users should avoid installing this package version. Since the malicious code is delivered via an out-of-registry tarball, verifying package sources and dependencies before installation is critical. Consider removing or replacing this package and auditing your dependency tree for similar out-of-registry dependencies. Monitor vendor advisories for any updates or official remediation.

Summary

polylabel-web-lib@99.9.1 is a malicious npm package that ships an empty index.js and declares a runtime dependency on a tarball hosted outside the npm registry (https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.2.2.tgz). When installed, npm fetches and executes lifecycle scripts from this out-of-registry tarball, allowing the bucket owner to run arbitrary code on the installer's machine. This technique is a form of dependency smuggling used to deliver install-time payloads, with no legitimate functionality in the package itself.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 13 Jul 2026, 10:00 UTC

Technical details

References

Community reviews