registry / depcruise-fmt / 99.9.1

depcruise-fmt@99.9.1

AI Security Review

scanned 1h ago · by lpm-firewall-ai

Installing this package causes npm to retrieve the declared external tarball dependency. No package-local execution or payload behavior is present.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install

Impact

The unverified external archive supplies install-time dependency code.

Mechanism

Remote tarball dependency resolution

Rationale

The external tarball is a concrete unresolved code-delivery path, while the package has no lifecycle scripts and an empty entrypoint. This warrants a warning rather than a block.

Evidence

package.jsonindex.js

Network endpoints1

ltidi.storage.googleapis.com/depenconf/ltidisafe-3.7.3.tgz

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-14054

Source

OpenSSF Malicious Packages via OSV

Summary

The external tarball is a concrete unresolved code-delivery path, while the package has no lifecycle scripts and an empty entrypoint. This warrants a warning rather than a block.

References

OSV advisory

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

Manifest installs dependency from an external tarball URL rather than a registry version.

Evidence against

No lifecycle hooks are declared.
The main entrypoint only exports an empty object.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 35 B of source

Source & flagged code

2 flagged

package.jsonView file

Lines 1-15json

2 "name": "depcruise-fmt",

3 "version": "99.9.1",

4 "description": "",

5 "main": "index.js",

6 "scripts": {

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg · L6

7 "test": "echo \"Error: no test specified\" && exit 1"

8 },

9 "dependencies": {

10 "ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.7.3.tgz"

11 },

Medium

Suspicious Dependency Evidence

Manifest installs dependency from an external tarball URL rather than a registry version.

package.jsonView on unpkg · L9

12 "author": "",

13 "license": "ISC"

14}

Source & flagged code

2 flagged · loading source

package.jsonView file

•Remote tarball dependency specs: ltidisafe@https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.7.3.tgz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

9"dependencies": { "ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.7.3.tgz" }

Medium

Suspicious Dependency Evidence

Manifest installs dependency from an external tarball URL rather than a registry version.

package.jsonView on unpkg · L9

Findings

2 Medium1 Low

MediumRemote Tarball Dependencypackage.json

MediumSuspicious Dependency Evidencepackage.json

LowScripts Present