MAL-2026-13980

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/eslint-generate-release/MAL-2026-13980.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-13980
Published
2026-08-13T21:07:45Z
Modified
2026-08-13T21:30:25.428259384Z
Summary
Malicious code in eslint-generate-release (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (4478598213eba844460a99bf323ef024e2fb906c918736cc7e593745029e16b4)

eslint-generate-release@99.9.1 is a hollow package whose index.js exports an empty object and whose only effect on install is dependency resolution. package.json declares a runtime dependency ltidisafe whose version specifier is not an npm-registry version but a direct HTTPS tarball URL: https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.6.3.tgz. On npm install, npm fetches and installs that off-registry tarball into node_modules, introducing code that never passed through the npm registry. The package name mimics the ESLint ecosystem and the 99.9.1 version is a version-squat pattern; combined with the empty main entry, the package functions purely as a smuggling wrapper for the URL-referenced payload.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-017679",
            "import_time": "2026-08-13T21:20:57.208693626Z",
            "sha256": "4478598213eba844460a99bf323ef024e2fb906c918736cc7e593745029e16b4",
            "versions": [
                "99.9.1"
            ],
            "source": "amazon-inspector",
            "modified_time": "2026-08-13T21:07:45Z"
        }
    ]
}
References
Credits

Affected packages

npm / eslint-generate-release

Package

Name
eslint-generate-release
View open source insights on deps.dev
Purl
pkg:npm/eslint-generate-release

Affected ranges

Affected versions

99.*
99.9.1

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "tlsh": "8ce072200a2466330ec500b2882aa59bf371ce4f0808bc1c9bef042c818da7328fa39d",
            "sha256": "2a9d5b693953952399623eed803a14b05446bc551f5b2698842b3f6546010eef"
        }
    ],
    "package_integrity": [
        {
            "filename": "eslint-generate-release-99.9.1.tgz",
            "hashes": {
                "sha1": "d26d1b0d80367330ccd0847a15bdcbc63be57bc7",
                "sha512_sri": "sha512-xBSfaniBhrujQAR3/4Lo8dvNhS81Y6XepSUfplVORRKqi/kZNtGYlg4VfXVn0ooi3PeZNdBVnhBQElanM2RHQQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/eslint-generate-release/MAL-2026-13980.json"