MAL-2026-6998

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (f73e9c228fc5188d602b213f2c6e7f88d6acbb4a9381667b7c33e4cb825aedf2) Package `higherlogic-ocfe@99.9.1` is a dependency-confusion lure targeting the Higher Logic vendor namespace. The published `index.js` is an empty `module.exports = {}` — the package ships no functionality. Its sole dependency is declared in `package.json` as a direct tarball URL (`https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.1.4.tgz`) rather than a registry-hosted version. On `npm install`, npm fetches that tarball from an arbitrary Google Cloud Storage bucket and executes any lifecycle scripts it contains on the installer's machine. The high version `99.9.1` is the standard dependency-confusion pattern used to override an internal private package of the same name during resolution, and the bucket path segment `depenconf` reinforces the attack intent. The installer cannot audit the fetched bytes via normal registry tooling, and the tarball contents are mutable at the bucket owner's discretion.