Malicious code in cspell-esm (npm)
cspell-esm, a typosquatting package on npm resembling the legitimate 'cspell' library, contained malicious code delivered through a smuggled off-registry dependency (ltidisafe) hosted on a Google Cloud Storage bucket. Installation triggered execution of lifecycle scripts and code from the attacker-controlled dependency.
- Disclosed
- Last updated
- Blast radius
- Any developer or system that installed cspell-esm from npm and executed npm install, which would trigger lifecycle scripts and code execution from the smuggled ltidisafe dependency.
- Ecosystems
- Attack vectors
- Affected entities
- cspell-esmMalicious npm package with lookalike name resembling the legitimate 'cspell' library
- ltidisafeSmuggled dependency fetched from off-registry HTTPS URL (https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.6.7.tgz)
cspell-esm is a malicious npm package that uses a lookalike name to resemble the widely-used 'cspell' library. The package itself exports an empty object and provides no legitimate functionality, serving as a dropper lure.\n\nThe attack vector relies on a smuggled dependency: the package.json pins 'ltidisafe' to a raw HTTPS URL on a Google Cloud Storage bucket (https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.6.7.tgz) rather than a registry-published, version-pinned artifact. This bypasses normal npm registry controls.\n\nWhen npm install is executed, npm fetches the tarball from the author-controlled bucket and installs it into the dependency tree. This process triggers execution of any lifecycle scripts and main-module code from ltidisafe on the installer's machine, delivering the actual malicious payload.\n\nThe incident was identified by Amazon Inspector and credited to the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- cspell-esm
- ltidisafe
- Domains
- ltidi.storage.googleapis.com
Remediation
- Remove cspell-esm from all package.json files and dependency trees immediately
- Audit npm install logs and system activity during any period when cspell-esm was installed to detect potential code execution from ltidisafe
- Use the legitimate 'cspell' package from npm instead of cspell-esm
- Implement npm package name verification and typosquatting detection in your dependency management process
- Consider using npm audit and supply chain security tools to detect off-registry dependencies and suspicious package patterns
- Review and restrict outbound HTTPS connections to non-standard package sources in your build and deployment environments
Sources
- GitHub Advisory GHSA-mpgx-7wm7-ggxm · GitHub Advisory Database
Cite this entry
"Malicious code in cspell-esm (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malicious-code-in-cspell-esm-npm-10p1c6
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - containedcritical
Malicious code in @polymarkets/clob-client-v2 (npm)
@polymarkets/clob-client-v2 (npm) is a malicious package that typosquats the legitimate @polymarket scope and redirects its inquirer dependency to a lookalike npm registry (registrynpmjs.to) to deliver arbitrary code execution during installation and on first require.
npmTyposquattingCompromised packageDependency confusion - containedcritical
Malicious code in @depup/astro (npm)
@depup/astro is a malicious npm package that impersonates the legitimate Astro framework by spoofing author and repository metadata, while systematically replacing well-known dependencies with lookalike packages under different maintainers. The package source code was rewritten to import from these lookalike packages, causing normal npm installs to execute attacker-controlled code instead of legitimate upstream dependencies.
npmTyposquattingDependency confusionCompromised package - resolvedcritical
Malicious code in tinkoff-statist-browser-typed-client-sme.compliance.web.events (npm)
The npm package tinkoff-statist-browser-typed-client-sme.compliance.web.events contains malicious code that downloads and executes platform-specific binary payloads on require. The package name mimics an internal Tinkoff namespace to evade detection and uses DNS TXT covert channels as a fallback delivery mechanism.
npmCompromised packageTyposquattingDependency confusion