Malicious code in check-audit (npm)
check-audit@99.9.1 is a malicious npm package that acts as a dropper, pulling attacker-controlled code from an external Google Cloud Storage URL (ltidi.storage.googleapis.com) during installation. The package is otherwise empty and designed to inject arbitrary dependencies into the installer's node_modules.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installs check-audit@99.9.1 from npm registry
- Ecosystems
- Attack vectors
- Affected entities
- check-audit · 99.9.1
check-audit@99.9.1 is a hollow npm package with no author, description, or meaningful code. Its sole function is to pull a dependency named ltidisafe from an attacker-controlled Google Cloud Storage URL: https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.6.5.tgz.
This URL bypasses npm registry scanning and the tarball contents are mutable, allowing the attacker to modify the payload at any time. When npm install is executed, the downloaded code and any lifecycle scripts execute directly in the installer's node_modules directory with full privileges.
The version number (99.9.1) and hollow package structure are consistent with a lure/dropper pattern designed to inject attacker-controllable code into the dependency tree at install time. This represents a direct supply chain compromise targeting npm users.
Indicators of compromise
- Packages
- check-audit@99.9.1
- ltidisafe
- Domains
- ltidi.storage.googleapis.com
Remediation
- Immediately remove check-audit@99.9.1 from any package.json files
- Audit npm install logs and node_modules for the presence of ltidisafe or other unexpected packages
- Regenerate any credentials or secrets that may have been exposed during installation
- Review and revoke any suspicious activity on affected systems
- Use npm audit to scan for other malicious packages
- Consider using npm package lock files and integrity verification to prevent similar attacks
Sources
- GitHub Advisory GHSA-xcx8-wpwx-h8f4 · GitHub Advisory Database
Cite this entry
"Malicious code in check-audit (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malicious-code-in-check-audit-npm-184jn5
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in stillm4ddpocs-demo-sprocket (npm)
The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)
Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in lumen-pages-community (npm)
lumen-pages-community@9.9.9 on npm contains malicious code that executes a postinstall hook to exfiltrate installer metadata (hostname, username, working directory, platform, Node version, CI environment, npm user-agent) to a hardcoded webhook.site URL. The high version number and lack of functionality suggest a dependency-confusion attack.
npmCompromised packageDependency confusion - resolvedcritical
Malicious code in @gfe/lx-watcher (npm)
The npm package @gfe/lx-watcher contained malicious code that exfiltrated host metadata (hostname, OS username, working directory, timestamp) via npm lifecycle hooks to a hardcoded webhook.site endpoint. The package exploited dependency confusion by using a scoped name (@gfe/*) with a no-op stub, allowing silent resolution against the public registry while leaking host identifiers.
npmDependency confusionCompromised package