MAL-2026-13982
Malicious code in in-install (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (58b0bedeac5b8460ad12e0ef3e013f8146eb2b7adacd483c3b8833f1dcbb457b) in-install@99.9.1 declares its `ltidisafe` dependency as an HTTPS tarball URL hosted on a Google Cloud Storage bucket (`https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.6.9.tgz`) rather than a registry-resolved package. Running `npm install in-install` fetches that tarball and installs it into the installer's node_modules, executing whatever install/import-time code it ships. The bucket path is mutable by whoever controls it, is not subject to npm registry review, and is not pinned to a registry-audited artifact, so the bytes delivered at install time can be changed at any moment without a version bump. The package's own index.js is an empty export; the sole observable effect of installing it is pulling arbitrary off-registry code into the installer's environment.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for in-install (npm). Pin to a known-safe version or switch to an alternative.