Malicious code in fanarena-common (npm)

{
  "id": "0b41fe78034c1328d7f347d5888156d2598579fc020bbc9bc4c94dfa57ec71e0",
  "url": "https://osv.dev/vulnerability/MAL-2026-18063",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in fanarena-common (npm)",
    "summary": "--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (e0da88f07c843cff93266258d7d4e30c369b05fb52974170e25abb1e6c33e3c5) package.json declares a dependency `ltidisafe` sourced directly from the bare HTTPS URL `https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.9.8.tgz` rather than from the npm registry. On `npm install`, npm fetches and installs whatever bytes that URL returns, with no registry-side integrity check, no version resolution, and no publisher binding — and executes any lifecycle scripts contained in the fetched tarball. The host is unrelated to any declared repository or homepage for this package, and the implausibly high package version (99.9.1) is consistent with a dependency-confusion / forced-resolution shape against an internal package of the same `fanarena-*` family. The manifest alone is the attack surface: regardless of the current contents of the remote tarball, the publisher of that URL can change the bytes installers execute at any time. ## Source: ossf-package-analysis (d81686cb5b877d15810946a299ba819a875a3304e45d65a3fdb83c5473ac664b) The OpenSSF Package Analysis project identified 'fanarena-common' @ 99.9.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.",
    "evidence": "osv:MAL-2026-18063",
    "products": [
      {
        "name": {
          "value": "fanarena-common",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "99.9.1",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-18063",
      "aliases": [
        "MAL-2026-18063"
      ],
      "affected": [
        {
          "package": {
            "name": "fanarena-common",
            "purl": "pkg:npm/fanarena-common",
            "ecosystem": "npm"
          },
          "versions": [
            "99.9.1"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/fanarena-common/MAL-2026-18063.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "package.json",
                  "tlsh": "9ce0cd20566565334ec911b2486a6557f3715e5f0805bc0c5bdf141c418de7368fd25d",
                  "sha256": "4747d208208133a30560ef51703a1d036ccf94650c55250f3b6608a81279c127"
                }
              ],
              "package_integrity": [
                {
                  "hashes": {
                    "sha1": "c67384ab0a51d7ed6e6c43287a5f49cc6dff405e",
                    "sha512_sri": "sha512-RbvIoePB5XRvoH3aQzAuJjGqsN9WSfZDphrf3aTeUSTGYxA9U6iyY1iGSepICe70Mo5/WTS853AMA+rxMF95hQ=="
                  },
                  "filename": "fanarena-common-99.9.1.tgz"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-22T06:45:04.811221446Z",
      "provider": "osv",
      "references": [
        "https://www.npmjs.com/package/fanarena-common/v/99.9.1"
      ],
      "provider_metadata": {
        "malicious-packages-origins": [
          {
            "sha256": "d81686cb5b877d15810946a299ba819a875a3304e45d65a3fdb83c5473ac664b",
            "source": "ossf-package-analysis",
            "versions": [
              "99.9.1"
            ],
            "import_time": "2026-10-20T04:20:16.090068027Z",
            "modified_time": "2026-10-20T03:55:45Z"
          },
          {
            "id": "IN-MAL-2026-021563",
            "sha256": "e0da88f07c843cff93266258d7d4e30c369b05fb52974170e25abb1e6c33e3c5",
            "source": "amazon-inspector",
            "versions": [
              "99.9.1"
            ],
            "import_time": "2026-10-22T06:30:22.988297425Z",
            "modified_time": "2026-10-22T05:48:09Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 404572,
  "published_at": "2026-10-20T03:55:45+00:00"
}