OSV ID
MAL-2026-13983
Ecosystem
npm
Summary
Package knip-bun typosquats the popular knip linter. The main module is an empty stub (module.exports = {}), and package.json declares a dependency ltidisafe pinned to an arbitrary Google Cloud Storage URL (https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.6.8.tgz) rather than a package on the npm registry. On npm install, npm downloads and installs the tarball from that bucket into the installer's dependency tree and runs whatever install/lifecycle logic it contains. The bucket is unaffiliated with the knip or bun projects, and the fetched tarball is fully controlled by whoever owns that GCS bucket.
Source: amazon-inspector (3d412258df9a21f510333926a9be29bed8ae6368e549e295c84e187bdc1a3725)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.