paychex-pdftron

Details

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (d32ec8b2ca67156d94943a27b9b7c98f1888d530d7a6f947e49b40f52ec054b3)
[email protected] ships an empty stub (module.exports = {}) and declares its sole dependency `ltidisafe` as a bare HTTPS tarball URL (https://ltidi.storage.googleapis.com/depenconf/ltidisafe-4.0.5.tgz) rather than a registry version range. On `npm install`, npm fetches whatever bytes that URL returns and installs the resulting package, executing any lifecycle scripts it contains — with no version pin, no integrity hash, and no signature verification. The package name resembles an internal Paychex scope, the version is an implausibly high `99.9.1` (a dependency-confusion resolution tactic), the URL path segment is `depenconf`, and the host is unrelated to any legitimate Paychex or pdftron domain. The manifest alone is the attack surface: resolving this dependency pulls attacker-controlled code into the installer's build environment.

Compromised versions (1)

• 99.9.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.