Race in V8 in Google Chrome prior to 144.0.7559.99 allowed a remote attacker to potentially exploit type confusion via a crafted HTML page. (Chromium security severity: High)
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (cadcdda902675162dd9cfabd9d8133986723d4c956437633f36a5a07b776ef59)
firefly-utilities-helper@99.9.1 ships an empty stub (index.js: `module.exports = {};`) with no description, author, or repository, but declares a single dependency `ltidisafe` as a direct tarball URL: `https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.0.6.tgz`. The bucket is on Google Cloud Storage, unrelated to any documented publisher, and the bucket/path naming (`ltidi`/`depenconf`) is consistent with a dependency-confusion staging area. URL-tarball dependencies bypass the npm registry's visibility, signature, and tooling — `npm install` will fetch the.tgz directly and execute any preinstall/install/postinstall lifecycle scripts it ships, with no hash pin, no signature, and no registry review. The wrapper contributes no functionality; its only effect on install is to smuggle the off-registry tarball into the installer's dependency tree. The high version number (99.9.1) and absent metadata are also consistent with a dependency-confusion lure intended to outrank an internal package of the same name.
## Source: ghsa-malware (618392bced7b75db7d804281a68124e3827f13da40512505dfadb7984878d722)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
## Source: ossf-package-analysis (783cf770777fff7cfffc2abec6cebd37f9e11f9e219c95e9879dda1222f9177c)
The OpenSSF Package Analysis project identified 'firefly-utilities-helper' @ 99.9.1 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
The npm package 'via-city-tools-m-particle' version 99.9.1 is a malicious package that exports no functionality but declares a dependency on an off-registry tarball hosted on a generic Google Cloud Storage bucket. Installing this package causes npm to fetch and install this arbitrary tarball, which may execute lifecycle scripts automatically on the installer's machine. The package metadata is minimal and resembles legitimate tooling to lure victims via dependency confusion. Any system with this package installed should be considered fully compromised, and all secrets and keys on that system should be rotated immediately from a different machine.
The npm package ui-ng-components version 99.9.1 is a malicious package designed for dependency confusion attacks. It contains no legitimate code but declares a dependency on a remote tarball hosted outside the npm registry. Installing this package triggers execution of potentially harmful lifecycle scripts from the external tarball, compromising the installer's machine. Any system with this package installed should be considered fully compromised, and all secrets and keys on that system must be rotated immediately. Removal of the package alone does not guarantee full remediation due to possible persistent malicious activity.
The npm package uipath-sugar-sell version 99.9.1 is a malicious package designed using a dependency confusion technique. It contains no actual functionality but depends on a tarball hosted on a Google Cloud Storage bucket, which can execute arbitrary code during installation. Installing this package can lead to full system compromise, and any secrets or keys on the affected system should be rotated immediately. Removal of the package does not guarantee elimination of all malicious components due to potential persistent compromise.
The npm package tivo-codelib-a version 99.9.1 is a malicious package that acts as a hollow lure. It contains an empty stub but declares a runtime dependency on an attacker-controlled tarball hosted on a Google Cloud Storage bucket outside the official npm registry. This external dependency can be swapped at any time to deliver arbitrary malicious code during installation. Systems with this package installed should be considered fully compromised, and all secrets and keys on those systems should be rotated immediately. Removal of the package alone may not fully remediate the compromise.
The npm package @webda-features/dashboard version 99.9.1 is a malicious package that acts as an empty wrapper but installs a dependency from an untrusted external Google Cloud Storage URL. This external tarball can contain arbitrary code, leading to full system compromise upon installation. The package name mimics a legitimate scope to facilitate dependency confusion attacks. Systems with this package installed should be considered fully compromised, and all secrets and keys must be rotated from a clean environment.
The npm package @webd-infra/query-designer-domain version 99.9.1 is identified as malicious. It declares a dependency on an off-registry tarball hosted on a Google Cloud Storage bucket, allowing the bucket owner to execute arbitrary code during installation. The package itself contains no runtime code other than resolving and executing this external tarball. Installation of this package can lead to full system compromise, requiring immediate secret and key rotation and package removal.
The npm package @webda-infra/search version 99.9.1 is a malicious placeholder designed to execute arbitrary code during installation. It declares a dependency on a package hosted on an unverified Google Cloud Storage URL, allowing the attacker to serve any code, including install scripts, to the victim. Installing this package can lead to full system compromise. Immediate removal and secret/key rotation are strongly advised.
The npm package privacy-sdk@99.9.1 is a malicious package designed to deliver attacker-controlled code during installation. It acts as a hollow wrapper that fetches and installs a tarball from an untrusted Google Cloud Storage URL, bypassing npm's security mechanisms. This package uses a high version number to outrank legitimate internal packages, increasing the risk of dependency confusion attacks. Installing this package can fully compromise the host system, potentially exposing all stored secrets and keys.
The npm package commons-ui-styles@99.9.1 is a malicious placeholder designed for dependency confusion attacks. It declares a transitive dependency on a tarball hosted on a Google Cloud Storage bucket controlled by an unknown party, allowing arbitrary code execution during installation. Installing this package can lead to full system compromise, requiring immediate secret and key rotation and removal of the package.
The npm package corporate-front-vue@99.9.1 is a malicious package designed to perform dependency confusion by referencing a tarball hosted outside the npm registry. Installing this package causes npm to fetch and execute code from an attacker-controlled Google Cloud Storage URL, potentially compromising the host system. The package itself is a near-empty shim that exists solely to load this external malicious payload. Any system with this package installed should be considered fully compromised, and all secrets and keys on that system should be rotated immediately. Removal of the package does not guarantee full remediation due to the potential for persistent malicious code.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (751317dcad79cec866b8dc69cd60b39e3be8e1bcc45746039835b04ce32445b0)
package.json declares its only dependency `ltidisafe` as a direct HTTPS tarball URL (`https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.0.2.tgz`) hosted on a generic Google Cloud Storage bucket rather than resolved from the npm registry. On `npm install mazemap`, npm fetches and installs that arbitrary tarball, executing any lifecycle scripts (preinstall/install/postinstall) it contains — the tarball is bucket-owner-mutable and not subject to registry vetting. The package itself is a hollow lure: `index.js` is a 35-byte `module.exports = {};`, with no description, no author, ISC default license, and version `99.9.1` — a recognized dependency-confusion technique for overriding an internal package of the same name via a higher public version. The bucket path segment is literally `depenconf`. The combination of hollow main, inflated version, anonymous GCS-hosted dependency, and name collision with a real product (MazeMap) is a dependency-confusion / smuggling shape whose only on-install effect is to pull and execute attacker-controlled code from a non-registry source.
## Source: ghsa-malware (b2544226891e60a2b6f33b0aacf3e4669fe4ce13220f01bd40a84c8657fe0518)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (bf143361939feffe7099c14acc7cf41a401681481e932e15d6054dde49e88f94)
localization-lib@99.9.1 is an empty shell package: `index.js` is `module.exports = {}` and `package.json` has no description or author. Its `dependencies` declares `"ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.0.1.tgz"`, resolving a transitive dependency directly from a third-party Google Cloud Storage bucket rather than the npm registry. On `npm install`, npm fetches and installs that opaque tarball and executes any lifecycle hooks it declares on the installer's machine. The version `99.9.1` is the canonical outranking-version pattern used in dependency-confusion attacks to override a legitimate internally-named package, and the URL path literally contains the token `depenconf`. The package has no functional purpose other than smuggling this off-registry dependency into the installer's environment.
## Source: ghsa-malware (401dface4dee0f5b93603c52d947b3e856983c806dca6453edc9efef6afa482b)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
The npm package housecall-ui@99.9.1 is a hollow package that acts as a dependency confusion lure. It contains no functionality itself but declares a runtime dependency on a tarball hosted on a third-party Google Cloud Storage bucket controlled by an attacker. Installing this package causes npm to fetch and execute untrusted code from mutable infrastructure outside the npm registry, leading to full system compromise. The package name mimics a legitimate internal package to increase the chance of accidental installation. Any system with this package installed should be considered fully compromised, and all secrets on it must be rotated immediately.
The npm package '@shell-landing/routes' version 99.9.5 contains malicious code that exfiltrates sensitive host information during installation. Its postinstall script sends the contents of the host's /etc/passwd file and encoded host identity data to attacker-controlled domains. This package appears to be part of a dependency confusion attack targeting internal package names. Any system installing this package risks full compromise, requiring immediate secret and key rotation and package removal.
The npm package @easy-entry/outside-registration-fop-navigator version 99.9.5 contains malicious code that executes automatically upon installation. The postinstall script sends sensitive system information, including the contents of /etc/passwd and host identity details, to attacker-controlled domains. This behavior results in a full compromise of any system where the package is installed.
The npm package @shell-cabinet/routes version 99.9.5 contains malicious code that executes during installation. Its postinstall script exfiltrates sensitive system information including the contents of /etc/passwd and host identifiers by sending data to attacker-controlled domains. This behavior occurs unconditionally and is unrelated to any legitimate package functionality. Systems with this package installed should be considered fully compromised, and all secrets and keys stored on those systems must be rotated immediately. Removing the package does not guarantee removal of all malicious software introduced.
The npm package @easy-entry/routes version 99.9.5 contains malicious code that exfiltrates sensitive system information during installation. Its postinstall script sends the contents of the /etc/passwd file and encoded system identity data to attacker-controlled domains. The package has no legitimate functionality and is designed to impersonate an internal package to trick dependency resolution. Systems with this package installed should be considered fully compromised.
The npm package @easy-entry/landing-routes version 99.9.5 contains malicious code that executes automatically upon installation. It exfiltrates sensitive host information including the contents of /etc/passwd and host identifiers such as hostname, home directory, and username to attacker-controlled endpoints. This occurs via a postinstall hook that uses curl and a JavaScript script to leak data through DNS and HTTP requests. Installation of this package results in a full compromise of the affected system, requiring immediate secret and key rotation and package removal, though full remediation cannot be guaranteed due to potential persistent control by the attacker.