eslint-generate-release@99.9.1

AI Security Review

scanned 2d ago · by lpm-firewall-ai

Installation fetches and installs code from a third-party tarball. The shipped entrypoint is inert, so risk is confined to the uninspected dependency payload.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install

Impact

Dependency content can execute its own install/runtime behavior outside this package's visible source.

Mechanism

remote tarball dependency installation

Rationale

The external tarball dependency is a concrete staged-payload delivery surface, but its contents are not present for source verification. No direct malicious behavior is visible in this package itself.

Evidence

package.jsonindex.js

Network endpoints1

ltidi.storage.googleapis.com/depenconf/ltidisafe-3.6.3.tgz

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-13980

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in eslint-generate-release (npm)

Details

eslint-generate-release@99.9.1 is a hollow package whose index.js exports an empty object and whose only effect on install is dependency resolution. package.json declares a runtime dependency `ltidisafe` whose version specifier is not an npm-registry version but a direct HTTPS tarball URL: https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.6.3.tgz. On `npm install`, npm fetches and installs that off-registry tarball into node_modules, introducing code that never passed through the npm registry. The package name mimics the ESLint ecosystem and the 99.9.1 version is a version-squat pattern; combined with the empty main entry, the package functions purely as a smuggling wrapper for the URL-referenced payload.

eslint-generate-release@99.9.1

AI Security Review

OSV Corroboration

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code