Malicious code in eslint-generate-prerelease (npm)

A targeted dependency-confusion attack was conducted against npm users via the package eslint-generate-prerelease. The attacker published version 99.9.1 under a name resembling internal tooling, using an inflated version number to win resolution against a legitimate private-registry package of the same name.\n\nThe published package contains only an empty module (index.js = 'module.exports = {};'), but declares a single dependency: ltidisafe, pinned not as a registry package but as a direct tarball URL (https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.6.2.tgz) on a Google Cloud Storage bucket. When npm install is executed, npm fetches this tarball from a location outside the registry's audit scope and executes any lifecycle scripts and main module it contains.\n\nThe attack pattern—version inflation, the path segment 'depenconf', and the use of an external tarball URL—is consistent with a deliberate dependency-confusion attack. The harm is delivered through the URL-pinned transitive dependency rather than the lure package itself.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.