registry / cspell-esm / 99.9.1

cspell-esm@99.9.1

AI Security Review

scanned 2d ago · by lpm-firewall-ai

No confirmed package attack surface was found. The package itself only exports an empty object; its manifest references a remote dependency tarball.

Static reason

One or more suspicious static signals were detected.

Trigger

Dependency installation fetches the declared tarball.

Impact

No malicious package behavior is established from this source.

Mechanism

Remote tarball dependency reference only.

Rationale

Direct inspection found no lifecycle execution or runtime capability beyond an empty export. The remote dependency URL is a supply-chain concern but is not proof that this package is malicious.

Evidence

package.jsonindex.js

Network endpoints1

ltidi.storage.googleapis.com/depenconf/ltidisafe-3.6.7.tgz

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13977

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in cspell-esm (npm)

Details

Package name resembles the widely-used 'cspell' library but its main entry (index.js) exports an empty object and provides no functionality. Its package.json pins its sole dependency 'ltidisafe' to a raw HTTPS URL on a Google Cloud Storage bucket (https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.6.7.tgz) rather than a registry-published, version-pinned artifact. On `npm install`, npm fetches this tarball from the author-controlled bucket and installs it into the dependency tree, executing any of its lifecycle scripts and main-module code on the installer's machine. The combination of a lookalike name, an empty implementation, and an off-registry dependency source is the dropper-lure shape: the lure package itself is inert, and installer-side code execution is delivered through the smuggled dependency.

References

OSV advisory PACKAGE

Decision evidence

public snapshot

AI called this Clean at 91.0% confidence as Benign with low false-positive risk.

Evidence for block

package.json pins its only dependency to a remote Google Cloud Storage tarball, creating an external supply-chain dependency.

Evidence against

No preinstall, install, or postinstall lifecycle hook is declared.
The sole runtime entrypoint exports an empty object and contains no execution, file, network, or child-process behavior.
No concrete malicious behavior is present in the inspected package source.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 35 B of source

Source & flagged code

2 flagged

package.jsonView file

Lines 1-15json

2 "name": "cspell-esm",

3 "version": "99.9.1",

4 "description": "",

5 "main": "index.js",

6 "scripts": {

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg · L6

7 "test": "echo \"Error: no test specified\" && exit 1"

8 },

9 "dependencies": {

10 "ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.6.7.tgz"

11 },

High

Suspicious Dependency Evidence

package.json pins its only dependency to a remote Google Cloud Storage tarball, creating an external supply-chain dependency.

package.jsonView on unpkg · L9

12 "author": "",

13 "license": "ISC"

14}

Source & flagged code

2 flagged · loading source

package.jsonView file

9"dependencies": { "ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.6.7.tgz" }

High

Suspicious Dependency Evidence

package.json pins its only dependency to a remote Google Cloud Storage tarball, creating an external supply-chain dependency.

package.jsonView on unpkg · L9

•Remote tarball dependency specs: ltidisafe@https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.6.7.tgz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

Findings

1 High1 Medium1 Low

HighSuspicious Dependency Evidencepackage.json

MediumRemote Tarball Dependencypackage.json

LowScripts Present