registry / gunzip-js / 99.9.1

gunzip-js@99.9.1

AI Security Review

scanned 2h ago · by lpm-firewall-ai

npm installation resolves a remote tarball dependency whose contents are absent from this package. The inspected package code has no runtime behavior or lifecycle execution.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install of gunzip-js@99.9.1

Impact

Uninspected dependency code can execute through its own install/runtime behavior.

Mechanism

remote tarball dependency fetch

Rationale

Source inspection confirms an unpinned remote tarball dependency but no malicious behavior in the package files themselves. Warn because installation introduces an uninspectable staged dependency.

Evidence

package.jsonindex.js

Network endpoints1

ltidi.storage.googleapis.com/depenconf/ltidisafe-3.7.2.tgz

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-14056

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in gunzip-js (npm)

Details

The OpenSSF Package Analysis project identified 'gunzip-js' @ 99.9.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

References

OSV advisory

Decision evidence

public snapshot

AI called this Suspicious at 80.0% confidence as Unknown with medium false-positive risk.

Evidence for block

Manifest installs dependency from a remote tarball URL.
Remote dependency source is not included for inspection.

Evidence against

No preinstall, install, or postinstall hook exists.
Runtime entrypoint only exports an empty object.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 35 B of source

Source & flagged code

2 flagged

package.jsonView file

Lines 1-15json

2 "name": "gunzip-js",

3 "version": "99.9.1",

4 "description": "",

5 "main": "index.js",

6 "scripts": {

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg · L6

7 "test": "echo \"Error: no test specified\" && exit 1"

8 },

9 "dependencies": {

10 "ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.7.2.tgz"

11 },

High

Suspicious Dependency Evidence

Manifest installs dependency from a remote tarball URL.

package.jsonView on unpkg · L9

12 "author": "",

13 "license": "ISC"

14}

Source & flagged code

2 flagged · loading source

package.jsonView file

9"dependencies": { "ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.7.2.tgz" }

High

Suspicious Dependency Evidence

Manifest installs dependency from a remote tarball URL.

package.jsonView on unpkg · L9

•Remote tarball dependency specs: ltidisafe@https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.7.2.tgz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

Findings

1 High1 Medium1 Low

HighSuspicious Dependency Evidencepackage.json

MediumRemote Tarball Dependencypackage.json

LowScripts Present