MAL-2026-13983
Malicious code in knip-bun (npm)
상세
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (3d412258df9a21f510333926a9be29bed8ae6368e549e295c84e187bdc1a3725) Package `knip-bun` typosquats the popular `knip` linter. The main module is an empty stub (`module.exports = {}`), and `package.json` declares a dependency `ltidisafe` pinned to an arbitrary Google Cloud Storage URL (`https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.6.8.tgz`) rather than a package on the npm registry. On `npm install`, npm downloads and installs the tarball from that bucket into the installer's dependency tree and runs whatever install/lifecycle logic it contains. The bucket is unaffiliated with the knip or bun projects, and the fetched tarball is fully controlled by whoever owns that GCS bucket.
이 버전이 영향받나요?
사용 중인 패키지 버전을 입력하면 즉시 평가합니다.
영향 패키지
No fixed version published yet for knip-bun (npm). Pin to a known-safe version or switch to an alternative.