sc-hydrate-carousel-price (npm) 99.9.1: stub fetches an off-registry tarball on install; no safe version
Severity: critical · Patch status: no-fix-needed · Since 2026-10-20
sc-hydrate-carousel-price is a name-impersonation or dependency-confusion stub, not a hijack. Its only version in the registry history is 99.9.1, time-stamped 2026-10-20. Its shipped index file is an empty export, and its one dependency, ltidisafe 4.0.3, is declared as a raw HTTPS tarball on storage.googleapis.com (path depenconf) rather than a registry range. npm therefore installs whatever bytes that URL serves, with no pin or integrity check, and runs any lifecycle scripts inside them. OSV record MAL-2026-18291, published 2026-10-25 from an Amazon Inspector import, describes the package as a loader for externally hosted code and reads the version and name as a dependency-confusion shape. GitHub's advisory GHSA-9gcx-88qx-rxch rates it critical, with all versions affected and no patched version, and says any host that installed or ran it should be considered fully compromised, with secrets rotated from a clean machine. npm replaced the package with its own security placeholder on 2026-10-27. Last-month downloads to 2026-10-26 were 170.
What to do
- Search lockfiles, CI logs and node_modules for sc-hydrate-carousel-price and for any dependency whose version is an https:// tarball on ltidi.storage.googleapis.com (ltidisafe is the payload dependency)
- Treat any host or CI runner that installed or ran the package as fully compromised: rotate every secret it could read from a clean machine, then rebuild from a trusted image rather than trusting uninstall
- Block the package and the ltidi.storage.googleapis.com depenconf path in registry proxies, egress rules and dependency allowlists
- Review build and developer host logs for outbound connections in the window from 2026-10-20 onward
- Confirm that internal package names are reserved in your private registry scope, since the OSV record reads this as a dependency-confusion attempt
Sources
All live incidents on Threat Watch
