paychex-pdftron (npm): impersonation stub pulls an unpinned remote tarball on install; no safe version
Severity: critical · Patch status: no-fix-needed · Since 2026-10-20
paychex-pdftron is not a hijacked release and not a copy of a real product; it is a name-impersonation package. Its only version in the registry history is 99.9.1, time-stamped 2026-10-20. That version ships an empty module and one dependency, ltidisafe, declared as a raw HTTPS tarball on a storage.googleapis.com bucket path named depenconf instead of a registry version range. npm therefore fetches whatever that bucket serves, with no pin or integrity hash, and any install scripts inside it run on the installing machine. The OSV record MAL-2026-18289 (sourced from Amazon Inspector) reads the implausibly high version and the URL path as a dependency-confusion pattern. GitHub's malware advisory GHSA-9mgv-25w8-jwhf rates it critical and says any host where it was installed or run should be treated as fully compromised, with secrets rotated from a clean machine. npm removed the malicious version and replaced the package name with its own security placeholder on 2026-10-27. No patched version exists. The public PDFTron package on npm is @pdftron/webviewer, maintained by pdftron-dev, so the lookalike name is not a legitimate source. Last-month downloads to 2026-10-26 were 165.
What to do
- Search lockfiles, CI logs and node_modules for paychex-pdftron and for any dependency whose version is an https:// tarball URL on ltidi.storage.googleapis.com (ltidisafe is the known payload dependency)
- Treat any host or CI runner that installed paychex-pdftron as fully compromised: rotate every secret it could read from a clean machine, then rebuild or reimage it rather than trusting uninstall
- Block paychex-pdftron and the ltidi.storage.googleapis.com depenconf path in registry proxies, egress rules and dependency firewalls
- Check install logs for outbound connections to storage.googleapis.com from build hosts in the window after 2026-10-20
- Before adopting any replacement, confirm the publisher on the registry page; do not pick a package by name similarity
Sources
All live incidents on Threat Watch
