sc-announcer (npm) 99.9.1: stub fetches off-registry tarball on install; full compromise, no safe version
Severity: critical · Patch status: no-fix-needed · Since 2026-10-20
sc-announcer is a name-impersonation or dependency-confusion stub, not a hijack. Its only version in the registry history is 99.9.1, time-stamped 2026-10-20. That version ships an empty module and one dependency, ltidisafe, declared as a raw HTTPS tarball on storage.googleapis.com (path depenconf) instead of a registry range. npm therefore installs whatever that URL serves, with no pin or integrity check, and runs any install scripts in it. OSV record MAL-2026-18064 (sources: OpenSSF Package Analysis and Amazon Inspector) calls the version number implausibly high, reads the stub as a resolution-hijack lure for an internal name, and says the package contacts a domain tied to malicious activity. GitHub's advisory GHSA-fxw2-4j5q-6hwg rates it critical and says any host that installed or ran it should be treated as fully compromised, with secrets rotated from a clean machine. npm replaced the package with its own security placeholder on 2026-10-27, so the malicious version was public for about a week before the advisory. No patched version exists. Last-month downloads to 2026-10-26 were 312.
What to do
- Search lockfiles, CI logs and node_modules for sc-announcer and for any dependency whose version is an https:// tarball on ltidi.storage.googleapis.com (ltidisafe is the payload dependency)
- Treat any host or CI runner that installed or ran sc-announcer as fully compromised: rotate every secret it could read from a clean machine, then rebuild from a trusted image rather than trusting uninstall
- Block sc-announcer and the ltidi.storage.googleapis.com depenconf path in registry proxies, egress rules and dependency allowlists
- Review build and developer host logs for outbound connections in the window from 2026-10-20 onward
- Ask any internal team that owns a package with a similar name to confirm their internal registry scope is reserved, since the advisory describes this as a dependency-confusion shape
Sources
All live incidents on Threat Watch
