liferay-workspace-scripts

Details

**Severity:** Critical

**Affected versions:** `= 99.9.1`

## Source: amazon-inspector (3395e72ef77703732691fce21359206afea7598fb3d1dab29ded4b2e1c7cd28f)
package.json declares the sole dependency `ltidisafe` as a bare HTTPS tarball URL (`https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.5.tgz`) instead of a registry version range. On `npm install`, npm fetches that URL and installs whatever bytes it returns, executing any lifecycle scripts inside the fetched package, with no version pin and no integrity hash. The shipped `index.js` is an empty stub, so the manifest is the entire published surface. The package name mirrors Liferay-ecosystem tooling and the version `99.9.1` is implausibly high for a legitimate release, consistent with a dependency-confusion lure designed to win resolution against an internal package name. Whoever controls the Google Cloud Storage bucket controls code executed on every installer's machine at install time.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/ff41f6680a0ebbef2268cdb5daf253d4b400cb05/osv/malicious/npm/liferay-workspace-scripts/MAL-2026-17772.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/ff41f6680a0ebbef2268cdb5daf253d4b400cb05/osv/malicious/npm/liferay-workspace-scripts/MAL-2026-17772.json
- https://www.npmjs.com/package/liferay-workspace-scripts/v/99.9.1
- https://github.com/advisories/GHSA-p862-3rvq-8852

Compromised versions (1)

• = 99.9.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.