MAL-2026-10419

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/notifications-broadcast/MAL-2026-10419.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10419
Aliases
  • GHSA-hh3x-6gh6-rhxf
Published
2026-07-13T07:01:34Z
Modified
2026-08-02T23:34:58.379498844Z
Summary
Malicious code in notifications-broadcast (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (bd1aba4582464347961d36f63f501a5aaf2c190322e7ab8d8e4231c076b817e2)

notifications-broadcast@99.9.1 ships an empty index.js (module.exports = {};) with placeholder metadata (empty description, empty author, version 99.9.1 consistent with a dependency-confusion stub). Its only functional content is a dependency entry that resolves ltidisafe to a tarball URL at https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.3.4.tgz rather than the npm registry. The Google Cloud Storage bucket ltidi.storage.googleapis.com is not tied to a verifiable npm publisher identity, the tarball is not pinned by hash, and the bucket path segment depenconf matches the dependency-confusion attack shape. On npm install, npm fetches this tarball and installs its contents into the installer's node_modules, executing any lifecycle scripts and making its code reachable via require(). Whoever controls the GCS bucket therefore obtains code execution in the installer's environment via the transitive dependency, and the bucket contents can be mutated at any time without any change to this package.

Source: ghsa-malware (221cbd3bebb6a8bc5420efd81cd5375037d9f5302ac25b0016ff6ef059794a5c)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-07-13T07:40:13.451823654Z",
            "sha256": "bd1aba4582464347961d36f63f501a5aaf2c190322e7ab8d8e4231c076b817e2",
            "modified_time": "2026-07-13T07:01:34Z",
            "source": "amazon-inspector",
            "id": "IN-MAL-2026-009854",
            "versions": [
                "99.9.1"
            ]
        },
        {
            "import_time": "2026-08-02T22:41:05.010045Z",
            "sha256": "221cbd3bebb6a8bc5420efd81cd5375037d9f5302ac25b0016ff6ef059794a5c",
            "modified_time": "2026-07-31T23:46:42Z",
            "source": "ghsa-malware",
            "id": "GHSA-hh3x-6gh6-rhxf",
            "ranges": [
                {
                    "type": "SEMVER",
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ]
                }
            ]
        }
    ]
}
References
Credits

Affected packages

npm / notifications-broadcast

Package

Name
notifications-broadcast
View open source insights on deps.dev
Purl
pkg:npm/notifications-broadcast

Affected ranges

Type
SEMVER
Events
Introduced
0Unknown introduced version / All previous versions are affected

Affected versions

99.*
99.9.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/notifications-broadcast/MAL-2026-10419.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "7b86430c4f3df08f32dd2fc55b319c8e44bc4376cce07da8fe4130449c92582a",
            "path": "package.json",
            "tlsh": "8de07d304d6556334ec600b28c1b615bf3718e5f0405bc1c5bdb041c418cb7329f925d"
        },
        {
            "sha256": "322ee46d71101bed25f260f2e78a419b5472e28d1ba02831ced05c73b44e5bb8",
            "path": "index.js"
        }
    ],
    "package_integrity": [
        {
            "filename": "notifications-broadcast-99.9.1.tgz",
            "hashes": {
                "sha512_sri": "sha512-wzCYOaWodmnXCSuBs20RER/TokHrz+pQmV3CgfxbYs8xYGdhe49nikWZAPA+0i3pAEdCGtZ3qluU8dTMkmfiQg==",
                "sha1": "8c1d305b4b1f38c569dde275e8fae98a9253f76e"
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    },
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]