ccl-global-shopping

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (4f380c5b8a8363f9bdd4b9466bdbbeaed301ef5fe0facf7f64eb3296848f9f96)
package.json declares its sole dependency `ltidisafe` as a direct HTTPS tarball URL (https://ltidi.storage.googleapis.com/depenconf/ltidisafe-4.0.4.tgz) instead of a registry version range. On `npm install`, npm fetches whatever bytes that URL currently serves and runs any lifecycle scripts inside the fetched package, with no version pin and no integrity hash — the bucket owner controls the code executed on every installer's machine, and the content can be swapped at any time. The package's own shipped index.js is an empty stub (`module.exports = {};`), so the manifest URL is effectively the entire payload surface. The package name resembles a shopping/retail library, giving it the shape of a dependency-confusion or typosquat lure whose only install-time effect is to pull in attacker-controlled code from an off-registry location.

## Source: ossf-package-analysis (31f39d40e2c7700b1c070cbd26ea533789dc444daaf58e77d191f7eb10036fc9)
The OpenSSF Package Analysis project identified 'ccl-global-shopping' @ 99.9.1 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

Compromised versions (1)

• 99.9.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.