Malicious code in consumerweb-creditcollection (npm)
consumerweb-creditcollection@99.9.1 is a malicious npm package that uses dependency confusion to force installation of attacker-controlled code from a Google Cloud Storage bucket. The package exports an empty object but pulls in a dependency (ltidisafe) pinned to an arbitrary tarball URL outside the npm registry, bypassing security scanning.
- Disclosed
- Last updated
- Blast radius
- Any npm user who installed consumerweb-creditcollection@99.9.1
- Ecosystems
- Attack vectors
- Affected entities
- consumerweb-creditcollection · 99.9.1
- ltidisafedependency pulled from off-registry URL
consumerweb-creditcollection@99.9.1 was identified as a malicious npm package designed to deliver attacker-controlled code through a dependency-confusion attack vector. The package itself is hollow, exporting only an empty object from its main index.js file.
The attack mechanism relies on a dependency on ltidisafe pinned to a specific tarball URL hosted on a third-party Google Cloud Storage bucket (https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.5.3.tgz) rather than being resolved from the npm registry. This forces npm to download and execute code from an attacker-controlled external source, circumventing npm registry security scanning.
The attack exhibits classic dependency-confusion indicators: an artificially high version number (99.9.1), an internal-sounding package name, and a suspicious path segment (depenconf). The lure package's sole purpose is to inject attacker-hosted code into the installer's dependency tree.
The incident was identified and credited to the OpenSSF's malicious-packages repository.
Indicators of compromise
- Packages
- consumerweb-creditcollection@99.9.1
- Domains
- ltidi.storage.googleapis.com
Remediation
- Remove consumerweb-creditcollection@99.9.1 from all package.json files and lock files
- Audit npm install logs to identify any systems that installed this package
- Inspect systems that installed this package for signs of compromise or execution of code from the Google Cloud Storage bucket
- Review dependency trees for any unexpected or suspicious packages, particularly ltidisafe from non-registry sources
- Implement npm registry-only policies to prevent installation of packages from arbitrary URLs
- Monitor for similar dependency-confusion attacks using high version numbers or suspicious external URLs
Sources
- GitHub Advisory GHSA-qvf2-x454-7637 · GitHub Advisory Database
Cite this entry
"Malicious code in consumerweb-creditcollection (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-consumerweb-creditcollection-npm-i9soo0
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in bcc-design (npm)
bcc-design@9999.0.0 on npm is a dependency-confusion beacon package with no legitimate functionality. Its postinstall script exfiltrates the installer's hostname and system metadata to an attacker-controlled IP endpoint.
npmDependency confusionCompromised package - containedcritical
Malicious code in bcc-design-icons (npm)
bcc-design-icons@9999.0.0 on npm contains malicious postinstall script that exfiltrates hostname and package name to attacker-controlled IP 91.201.215.48:8000. The package lacks expected icon-library functionality and exhibits characteristics of a dependency-confusion attack targeting internal/private npm installers.
npmDependency confusionCompromised package - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in fastly-vcl-language-client (npm)
The npm package fastly-vcl-language-client contained malicious code in a preinstall script that collected system information and CI environment variables, exfiltrating data to an external webhook endpoint. The package appears to be a dependency-confusion attack targeting internal Fastly tooling.
npmCompromised packageDependency confusion