paychex-pdftron

GHSA-qg7g-2jr4-vjw8

Malicious code in paychex-pdftron (npm)

Details

**Severity:** Critical

**Affected versions:** `= 99.9.1`

## Source: amazon-inspector (d32ec8b2ca67156d94943a27b9b7c98f1888d530d7a6f947e49b40f52ec054b3)
[email protected] ships an empty stub (module.exports = {}) and declares its sole dependency `ltidisafe` as a bare HTTPS tarball URL (https://ltidi.storage.googleapis.com/depenconf/ltidisafe-4.0.5.tgz) rather than a registry version range. On `npm install`, npm fetches whatever bytes that URL returns and installs the resulting package, executing any lifecycle scripts it contains — with no version pin, no integrity hash, and no signature verification. The package name resembles an internal Paychex scope, the version is an implausibly high `99.9.1` (a dependency-confusion resolution tactic), the URL path segment is `depenconf`, and the host is unrelated to any legitimate Paychex or pdftron domain. The manifest alone is the attack surface: resolving this dependency pulls attacker-controlled code into the installer's build environment.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/b711d7c76f98b5044512e8c851547e8a05b2f959/osv/malicious/npm/paychex-pdftron/MAL-2026-18289.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/b711d7c76f98b5044512e8c851547e8a05b2f959/osv/malicious/npm/paychex-pdftron/MAL-2026-18289.json
- https://www.npmjs.com/package/paychex-pdftron/v/99.9.1
- https://github.com/advisories/GHSA-qg7g-2jr4-vjw8

Compromised versions (1)

= 99.9.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.