MAL-2026-13439

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/commonweb-balance/MAL-2026-13439.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13439
Published
2026-08-06T16:18:52Z
Modified
2026-08-06T23:50:06.989221001Z
Summary
Malicious code in commonweb-balance (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7455a26ab96be134244f14c67b9e3fbf63033f1b974cf45ad0620d5a6eda0581)

commonweb-balance@99.9.1 is an empty shell package (empty index.js, no functionality) whose only effect on install is resolving its single declared runtime dependency ltidisafe from a direct tarball URL at https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.4.5.tgz rather than from the npm registry. On npm install, npm downloads and installs whatever bytes are served at that URL into the installer's node_modules, bringing that code into the dependency tree outside npm registry review. The GCS bucket is publisher-unrelated (no matching author or homepage metadata on the host package) and mutable — whoever controls the bucket can change the served tarball contents at any time without republishing to npm. The host package has no legitimate function other than to pull this out-of-registry dependency into installers, matching the dependency-chain dropper / lure pattern.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "7455a26ab96be134244f14c67b9e3fbf63033f1b974cf45ad0620d5a6eda0581",
            "source": "amazon-inspector",
            "versions": [
                "99.9.1"
            ],
            "import_time": "2026-08-06T18:09:04.108821933Z",
            "modified_time": "2026-08-06T16:18:52Z",
            "id": "IN-MAL-2026-016672"
        }
    ]
}
References
Credits

Affected packages

npm / commonweb-balance

Package

Name
commonweb-balance
View open source insights on deps.dev
Purl
pkg:npm/commonweb-balance

Affected ranges

Affected versions

99.*
99.9.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature."
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/commonweb-balance/MAL-2026-13439.json"
indicators 
{
    "evidence_files": [
        {
            "tlsh": "a9e072304a606a334ec600b2486e641bf3b08f4f4408bc0c1fdf042c619dab32cf925c",
            "sha256": "79be26899e4a11579bdc2f74d2ede645253c7b51343541882ceba23ef4d3c4fe",
            "path": "package.json"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha1": "2e84af1b32c3c89c436a79d119eba7077172d1a0",
                "sha512_sri": "sha512-LWvVaDcSsj/PqtIGWYawGd+9oM40Mf97Z3Fk2Zf4pyZikjfLVLl8whnIRgiPgmiOOfFHiugBhCzjwE3uZHlcyg=="
            },
            "filename": "commonweb-balance-99.9.1.tgz"
        }
    ]
}