MAL-2026-10422

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sso-users-detection/MAL-2026-10422.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10422
Published
2026-07-13T07:00:55Z
Modified
2026-07-13T07:47:03.597572972Z
Summary
Malicious code in sso-users-detection (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (dc80441472ec24451f83aebdc186d5bc532ddadaac8888d3d30b72c17c94f993)

sso-users-detection@99.9.1 is a hollow package (main exports {}, empty author/description, inflated 99.9.1 version) whose sole effect on install is to pull a runtime dependency named ltidisafe from a raw tarball URL on a third-party Google Cloud Storage bucket (https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.3.1.tgz) instead of the npm registry. On npm install, npm fetches and installs that tarball, whose contents and lifecycle scripts (preinstall/install/postinstall) are entirely controlled by whoever owns the bucket and bypass npm registry scanning. The depenconf path segment, the inflated version number, and the empty index are consistent with a dependency-confusion lure whose only purpose is to smuggle attacker-controlled code into installer dependency trees.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "dc80441472ec24451f83aebdc186d5bc532ddadaac8888d3d30b72c17c94f993",
            "modified_time": "2026-07-13T07:00:55Z",
            "id": "IN-MAL-2026-009852",
            "source": "amazon-inspector",
            "versions": [
                "99.9.1"
            ],
            "import_time": "2026-07-13T07:40:13.326033358Z"
        }
    ]
}
References
Credits

Affected packages

npm / sso-users-detection

Package

Name
sso-users-detection
View open source insights on deps.dev
Purl
pkg:npm/sso-users-detection

Affected ranges

Affected versions

99.*
99.9.1

Database specific

indicators 
{
    "package_integrity": [
        {
            "hashes": {
                "sha512_sri": "sha512-Bix4rPxR1aAPbdU3p9iJFce4U81dZOHq5M3Q/zVn5TpegxOFS7uCaXaaXMzWAzo2TCH2XC0GT1/BmA6O/SiePA==",
                "sha1": "7673ab77df6a0f2c616d5bd631ef01aea163262c"
            },
            "filename": "sso-users-detection-99.9.1.tgz"
        }
    ],
    "evidence_files": [
        {
            "sha256": "c780a7e922260538ac7a8fa7d9598d22694227c9e03532caea9caf8045e0f778",
            "tlsh": "aae072200a2566334eda11b2882b651bf3708e5f0818bc0c5bef042c418df7b28fa26d",
            "path": "package.json"
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/sso-users-detection/MAL-2026-10422.json"