Malicious npm package ccl-global-shopping — full system compromise on install (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-10-20
The npm package ccl-global-shopping was published with a malicious 99.9.1 on 2026-10-20 and was flagged by GitHub on 2026-10-27. Its only registry history is that version, so it reads as a squatted name, not a takeover. OSV's amazon-inspector analysis says its sole dependency is a bare HTTPS tarball URL on a Google Cloud Storage host rather than a registry range. npm therefore fetches whatever the URL serves at install time and runs its lifecycle scripts, which means the payload runs during install. OpenSSF Package Analysis separately flagged 99.9.1 for communicating with a malicious domain. npm replaced the name with a security placeholder on 2026-10-27. No safe version exists. Any host that ran npm install on it should be treated as compromised, and secrets on it rotated from a clean machine.
What to do
- Treat every machine where ccl-global-shopping was installed as fully compromised; rebuild from a clean image and rotate all secrets from a different computer
- Remove the package from projects, lockfiles and CI; search lockfiles for the name and for bare HTTPS tarball dependency specs (the pattern OSV describes, with host ltidi.storage.googleapis.com)
- Block the name and that tarball host in the internal proxy and dependency scanning
- Review install logs from 2026-10-20 onward for npm lifecycle scripts that ran for this package
Sources
All live incidents on Threat Watch
