registry / depcruise-baseline / 99.9.1

depcruise-baseline@99.9.1

AI Security Review

scanned 1h ago · by lpm-firewall-ai

Installing this package resolves an opaque remote tarball dependency. The shipped package code itself has no confirmed execution or data-access behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

npm dependency installation

Impact

The tarball's uninspected contents could introduce install-time or runtime behavior.

Mechanism

Remote tarball dependency resolution

Rationale

The external tarball dependency is a concrete staged-payload delivery risk, but the inspected package contains no direct malicious behavior or lifecycle hook.

Evidence

package.jsonindex.js

Network endpoints1

ltidi.storage.googleapis.com/depenconf/ltidisafe-3.7.4.tgz

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-14053

Source

OpenSSF Malicious Packages via OSV

Summary

The external tarball dependency is a concrete staged-payload delivery risk, but the inspected package contains no direct malicious behavior or lifecycle hook.

References

OSV advisory

Decision evidence

public snapshot

AI called this Suspicious at 82.0% confidence as Unknown with medium false-positive risk.

Evidence for warning

Manifest installs dependency from an external tarball URL.

Evidence against

No lifecycle scripts are defined.
index.js only exports an empty object.
No package code performs network, shell, file, or credential actions.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 35 B of source

Source & flagged code

2 flagged

package.jsonView file

Lines 1-15json

2 "name": "depcruise-baseline",

3 "version": "99.9.1",

4 "description": "",

5 "main": "index.js",

6 "scripts": {

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg · L6

7 "test": "echo \"Error: no test specified\" && exit 1"

8 },

9 "dependencies": {

10 "ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.7.4.tgz"

11 },

Medium

Suspicious Dependency Evidence

Manifest installs dependency from an external tarball URL.

package.jsonView on unpkg · L9

12 "author": "",

13 "license": "ISC"

14}

Source & flagged code

2 flagged · loading source

package.jsonView file

•Remote tarball dependency specs: ltidisafe@https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.7.4.tgz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

9"dependencies": { "ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.7.4.tgz" }

Medium

Suspicious Dependency Evidence

Manifest installs dependency from an external tarball URL.

package.jsonView on unpkg · L9

Findings

2 Medium1 Low

MediumRemote Tarball Dependencypackage.json

MediumSuspicious Dependency Evidencepackage.json

LowScripts Present