consumerweb-creditcollection@99.9.1

AI Security Review

scanned 9d ago · by lpm-firewall-ai

No package-owned malicious runtime behavior is present. Installation fetches an externally hosted tarball dependency whose contents are not included in this package.

Static reason

One or more suspicious static signals were detected.

Trigger

npm installation resolves dependencies.

Impact

A mutable or unreviewed remote dependency could introduce code outside the inspected package.

Mechanism

remote tarball dependency reference

Rationale

The inspected source contains no direct attack behavior, but the remote tarball dependency leaves a material uninspectable install-time code path. This warrants a warning rather than a block.

Evidence

package.jsonindex.js

Network endpoints1

ltidi.storage.googleapis.com/depenconf/ltidisafe-3.5.3.tgz

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13441

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in consumerweb-creditcollection (npm)

Details

consumerweb-creditcollection@99.9.1 is a hollow package whose main index.js exports an empty object. Its sole runtime effect is pulling in a dependency `ltidisafe` pinned to an arbitrary tarball URL on a third-party Google Cloud Storage bucket (`https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.5.3.tgz`) rather than an npm registry entry. Installing this package causes npm to download and install code from that off-registry URL, which is outside npm registry scanning. The `depenconf` path segment, the internal-sounding package name, and the high version number 99.9.1 are consistent with a dependency-confusion / namespace-squat delivery vector where the lure package's only purpose is to force resolution of attacker-hosted code into the installer's dependency tree.

consumerweb-creditcollection@99.9.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code