MAL-2026-10419

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/notifications-broadcast/MAL-2026-10419.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10419
Published
2026-07-13T07:01:34Z
Modified
2026-07-13T07:47:03.422131501Z
Summary
Malicious code in notifications-broadcast (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (bd1aba4582464347961d36f63f501a5aaf2c190322e7ab8d8e4231c076b817e2)

notifications-broadcast@99.9.1 ships an empty index.js (module.exports = {};) with placeholder metadata (empty description, empty author, version 99.9.1 consistent with a dependency-confusion stub). Its only functional content is a dependency entry that resolves ltidisafe to a tarball URL at https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.3.4.tgz rather than the npm registry. The Google Cloud Storage bucket ltidi.storage.googleapis.com is not tied to a verifiable npm publisher identity, the tarball is not pinned by hash, and the bucket path segment depenconf matches the dependency-confusion attack shape. On npm install, npm fetches this tarball and installs its contents into the installer's node_modules, executing any lifecycle scripts and making its code reachable via require(). Whoever controls the GCS bucket therefore obtains code execution in the installer's environment via the transitive dependency, and the bucket contents can be mutated at any time without any change to this package.

Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-07-13T07:01:34Z",
            "id": "IN-MAL-2026-009854",
            "versions": [
                "99.9.1"
            ],
            "source": "amazon-inspector",
            "sha256": "bd1aba4582464347961d36f63f501a5aaf2c190322e7ab8d8e4231c076b817e2",
            "import_time": "2026-07-13T07:40:13.451823654Z"
        }
    ]
}
References
Credits

Affected packages

npm / notifications-broadcast

Package

Name
notifications-broadcast
View open source insights on deps.dev
Purl
pkg:npm/notifications-broadcast

Affected ranges

Affected versions

99.*
99.9.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/notifications-broadcast/MAL-2026-10419.json"
cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
indicators 
{
    "evidence_files": [
        {
            "tlsh": "8de07d304d6556334ec600b28c1b615bf3718e5f0405bc1c5bdb041c418cb7329f925d",
            "path": "package.json",
            "sha256": "7b86430c4f3df08f32dd2fc55b319c8e44bc4376cce07da8fe4130449c92582a"
        },
        {
            "path": "index.js",
            "sha256": "322ee46d71101bed25f260f2e78a419b5472e28d1ba02831ced05c73b44e5bb8"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-wzCYOaWodmnXCSuBs20RER/TokHrz+pQmV3CgfxbYs8xYGdhe49nikWZAPA+0i3pAEdCGtZ3qluU8dTMkmfiQg==",
                "sha1": "8c1d305b4b1f38c569dde275e8fae98a9253f76e"
            },
            "filename": "notifications-broadcast-99.9.1.tgz"
        }
    ]
}