Supply chain · npm · High

Critical Malicious npm Package: depcruise-wrap-stream-in-html

Threat Engine Auto-Feed · data current as of 2026-08-16

A malicious npm package, `depcruise-wrap-stream-in-html@99.9.1`, was identified as a hollow package designed to pull a runtime dependency from an external Google Cloud Storage bucket. This technique allows an attacker to execute arbitrary code on the installer's machine and bypass standard supply chain security controls, posing a critical risk to development environments.

  • Package: npm / depcruise-wrap-stream-in-html
  • Affected versions: = 99.9.1
  • Severity: critical
  • Reach: ~171/wk
  • Exposure: 70/100 (High)

What happened — Malicious package

The npm package `depcruise-wrap-stream-in-html` version `99.9.1` was found to be malicious. It is a 'hollow' package, meaning its primary function is to resolve a runtime dependency, `ltidisafe`, from an arbitrary HTTPS tarball URL hosted on a Google Cloud Storage bucket. This external tarball can be swapped by the bucket owner at any time, allowing for dynamic modification of the payload without republishing to npm.

How the attack works

This attack leverages a technique where a seemingly benign package includes a dependency that is fetched from an external, attacker-controlled URL. When `npm install` is executed, the external tarball is downloaded and its lifecycle scripts are run on the installer's machine. This method bypasses registry scanning and version pinning, enabling attackers to deliver arbitrary code and maintain persistence or escalate privileges within the compromised environment.

Who's exposed

Profiles most at risk

  • Development teams using the npm ecosystem
  • Organizations with CI/CD pipelines that automatically pull the latest package versions
  • Developers who might inadvertently install lookalike packages mimicking internal helpers

Conditions that increase exposure

  • Unpinned dependencies in `package.json` that allow `99.9.1` to be resolved
  • Lack of strict lockfile enforcement (`package-lock.json`) in build processes
  • Internal package mirrors that do not vet external dependencies or allow arbitrary URL fetches

Blast-radius scenarios

  • An attacker could achieve arbitrary code execution on developer workstations or build servers.
  • Compromised systems could lead to data exfiltration, credential theft, or further network penetration.
  • The blast radius extends to any system where this specific version of the package was installed, potentially affecting production builds if not properly isolated.

What to do (defensive)

Detect

  • Scan `package.json` and `package-lock.json` files for `depcruise-wrap-stream-in-html@99.9.1`.
  • Monitor network traffic during `npm install` for connections to `https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.7.5.tgz`.
  • Utilize software composition analysis (SCA) tools to identify known malicious packages and their dependencies.

Contain

  • Immediately block network access to `https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.7.5.tgz` at the firewall or proxy level.
  • Quarantine any systems identified as having installed `depcruise-wrap-stream-in-html@99.9.1`.
  • Implement strict package integrity checks and enforce the use of lockfiles in all build environments.

Remediate

  • Remove `depcruise-wrap-stream-in-html@99.9.1` from all `package.json` files and rebuild projects.
  • Perform a thorough audit of all systems that installed the package for any signs of compromise.
  • Update dependency management policies to disallow arbitrary URL dependencies and enforce package signing or trusted registries.

Frontier verdict — High

Prioritize immediate detection and removal of `depcruise-wrap-stream-in-html@99.9.1` due to its critical arbitrary code execution risk via external dependency fetching.

Sources

For detection-engineering and awareness only · point-in-time · not security advice · sourced from the GitHub Advisory Database.