Skip to content
supplychainattack.orgSupply chain attack incident catalog
containedcritical

Malicious code in napi-raw (npm)

napi-raw@99.9.1 is a malicious npm package that serves as a wrapper to inject an undisclosed external tarball (ltidisafe) from a Google Cloud Storage bucket into the dependency tree. The package contains no legitimate functionality and exists solely to smuggle opaque out-of-registry artifacts that execute with installer privileges.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Any npm consumer installing napi-raw@99.9.1
Ecosystems
npm
Attack vectors
Compromised packageDependency confusion
Affected entities
  • napi-raw · 99.9.1

napi-raw@99.9.1 was published to npm as a near-empty wrapper package. The package exports an empty object and contains no lifecycle scripts of its own, but declares a dependency on ltidisafe pointing to an arbitrary HTTPS tarball hosted on a generic Google Cloud Storage bucket (https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.6.1.tgz).

The tarball is hosted on an unaffiliated GCS bucket, is not resolved through the npm registry, and its contents are not subject to npm registry scanning. When napi-raw is installed, the external tarball is automatically resolved and installed into the dependency tree, and any lifecycle hooks or side effects it contains execute in the installer's environment.

Since napi-raw provides no legitimate functionality, its sole purpose is to serve as a delivery mechanism for the opaque external dependency. This allows malicious code to be injected into consumer environments while bypassing npm registry security controls.

The incident was identified by the OpenSSF malicious-packages project and reported via GitHub Security Advisory GHSA-r9mm-m965-266j.

Indicators of compromise

Packages
  • napi-raw@99.9.1
  • ltidisafe
Domains
  • ltidi.storage.googleapis.com

Remediation

  • Remove napi-raw from all dependency trees and lock files
  • Audit any systems where napi-raw@99.9.1 was installed for signs of compromise or execution of unknown code
  • Review and revoke any credentials or secrets that may have been exposed on affected systems
  • Check for unexpected dependencies or modifications to package-lock.json or yarn.lock files
  • Monitor for suspicious network activity or process execution originating from the ltidisafe tarball

Sources

  1. GitHub Advisory GHSA-r9mm-m965-266j · GitHub Advisory Database

Cite this entry

"Malicious code in napi-raw (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 13, 2026; last updated August 13, 2026. https://supplychainattack.org/incident/malicious-code-in-napi-raw-npm-1dz5qd

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. containedcritical

    Malicious code in stillm4ddpocs-demo-sprocket (npm)

    The npm package stillm4ddpocs-demo-sprocket version 999.9.12 contains malicious code that exfiltrates system and project metadata via multiple channels (HTTPS, HTTP, and DNS) to a hardcoded callback host. The package uses a high version number to exploit dependency-confusion attacks against organizations with internal packages of the same name.

    npmCompromised packageDependency confusion
  2. resolvedcritical

    Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

    Malicious package @usaa-grp-personal-profile/personal-profile-common version 999.0.0 published to public npm as a dependency-confusion attack targeting an organization's internal registry. The package contains preinstall and postinstall hooks that exfiltrate hostname, username, and working directory to an attacker-controlled OAST endpoint on every install.

    npmDependency confusionCompromised package
  3. resolvedcritical

    Malicious code in lumen-pages-community (npm)

    lumen-pages-community@9.9.9 on npm contains malicious code that executes a postinstall hook to exfiltrate installer metadata (hostname, username, working directory, platform, Node version, CI environment, npm user-agent) to a hardcoded webhook.site URL. The high version number and lack of functionality suggest a dependency-confusion attack.

    npmCompromised packageDependency confusion
  4. resolvedcritical

    Malicious code in @gfe/lx-watcher (npm)

    The npm package @gfe/lx-watcher contained malicious code that exfiltrated host metadata (hostname, OS username, working directory, timestamp) via npm lifecycle hooks to a hardcoded webhook.site endpoint. The package exploited dependency confusion by using a scoped name (@gfe/*) with a no-op stub, allowing silent resolution against the public registry while leaking host identifiers.

    npmDependency confusionCompromised package