registry / cxpw-offers / 99.9.1

cxpw-offers@99.9.1

AI Security Review

scanned 11d ago · by lpm-firewall-ai

Installation fetches a third-party tarball dependency. The package itself contains no executable attack logic.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install

Impact

Dependency contents are not inspectable in this package source.

Mechanism

Remote tarball dependency resolution

Rationale

No direct malicious behavior is established, but the externally hosted tarball dependency is an unresolved install-time risk.

Evidence

package.jsonindex.js

Network endpoints1

ltidi.storage.googleapis.com/depenconf/ltidisafe-3.4.9.tgz

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-10971

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in cxpw-offers (npm)

Details

The OpenSSF Package Analysis project identified 'cxpw-offers' @ 99.9.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

References

OSV advisory

Decision evidence

public snapshot

AI called this Suspicious at 80.0% confidence as Unknown with medium false-positive risk.

Evidence for block

package.json pins dependency to a remote tarball URL.

Evidence against

index.js only exports an empty object.
No lifecycle hooks are declared.
No package code performs network, file, shell, or credential actions.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 35 B of source

Source & flagged code

1 flagged

package.jsonView file

Lines 1-15json

2 "name": "cxpw-offers",

3 "version": "99.9.1",

4 "description": "",

5 "main": "index.js",

6 "scripts": {

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg · L6

7 "test": "echo \"Error: no test specified\" && exit 1"

8 },

9 "dependencies": {

10 "ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.4.9.tgz"

11 },

12 "author": "",

13 "license": "ISC"

14}

Source & flagged code

1 flagged · loading source

package.jsonView file

•Remote tarball dependency specs: ltidisafe@https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.4.9.tgz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

Findings

1 Medium1 Low

MediumRemote Tarball Dependencypackage.json

LowScripts Present