Malicious code in eslint-generate-release (npm)
eslint-generate-release@99.9.1 on npm is a malicious package that functions as a wrapper to smuggle an off-registry tarball dependency (ltidisafe) from a Google Cloud Storage URL into node_modules during installation. The package mimics the ESLint ecosystem and uses a version-squat pattern (99.9.1) to appear legitimate while delivering undisclosed code.
- Disclosed
- Last updated
- Blast radius
- Unknown; depends on adoption of the malicious package version
- Ecosystems
- Attack vectors
- Affected entities
- eslint-generate-release · 99.9.1
eslint-generate-release@99.9.1 is a malicious npm package discovered and reported by the OpenSSF. The package itself is hollow—its index.js exports an empty object and provides no functional code.
The attack vector is a dependency smuggling mechanism. The package's package.json declares a runtime dependency on ltidisafe with a version specifier that is not an npm registry version but a direct HTTPS tarball URL: https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.6.3.tgz. When npm install is executed, npm fetches and installs this off-registry tarball directly into node_modules, bypassing npm registry security controls and introducing code that never passed through npm's malware scanning.
The package employs multiple deception tactics: the name mimics the legitimate ESLint ecosystem, the version number (99.9.1) follows a version-squat pattern to appear authoritative, and the empty main entry conceals the true payload delivery mechanism. The package functions purely as a wrapper to deliver the URL-referenced payload.
Indicators of compromise
- Packages
- eslint-generate-release@99.9.1
- Domains
- ltidi.storage.googleapis.com
Remediation
- Remove eslint-generate-release@99.9.1 from package.json and package-lock.json
- Delete node_modules and reinstall dependencies from a clean state
- Audit package.json for other suspicious off-registry dependencies (direct URLs in version specifiers)
- Review npm audit logs for installations of eslint-generate-release
- Consider using npm's `--ignore-scripts` flag and package integrity verification tools to prevent similar attacks
- Monitor for any suspicious activity or data exfiltration from systems where this package was installed
Sources
- GitHub Advisory GHSA-wq2m-9vc9-746v · GitHub Advisory Database
Cite this entry
"Malicious code in eslint-generate-release (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malicious-code-in-eslint-generate-release-npm-xwx84m
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in @finaxis/common-js (npm)
The npm package @finaxis/common-js was published with a README and keywords copied from lodash v4.18.1, but contained a heavily obfuscated Xelis (XEL) proof-of-work cryptominer instead of lodash functionality. Consumers installing this package would unknowingly run a covert CPU/GPU miner on their systems.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in depcruise-wrap-stream-in-html (npm)
depcruise-wrap-stream-in-html@99.9.1 is a malicious npm package that mimics an internal helper of dependency-cruiser. It is a hollow package that downloads and executes arbitrary code from a Google Cloud Storage bucket during installation.
npmCompromised packageDependency confusionTyposquatting - resolvedcritical
Malicious code in akamai-sensor (npm)
A malicious npm package named akamai-sensor impersonated Akamai's legitimate sensor_data anti-bot SDK. The package contained hidden JavaScript code concealed using invisible Unicode characters and implemented a dynamic command-and-control channel via a Google Calendar dead-drop, enabling arbitrary code execution on installation.
npmCompromised packageTyposquatting - resolvedcritical
Malicious code in wct-st (npm)
The npm package wct-st contained malicious code in its postinstall lifecycle script that collected and exfiltrated host identifiers to a remote endpoint. The package name resembles the deprecated web-component-tester, consistent with a typosquatting attack.
npmCompromised packageTyposquatting