verdaccio-tarball-local-storage@38.1.12
Malicious code in verdaccio-tarball-local-storage (npm)
Analysis
verdaccio-tarball-local-storage is a combosquat of the legitimate @verdaccio/local-storage package. The package's preinstall hook (setup.mjs) downloads the Bun JavaScript runtime from github[.]com/oven-sh/bun and executes a 727KB obfuscated file (math_init.js) under it. The obfuscated bundle is unanalyzable and runs at install time via a downloaded binary, delivering an unknown payload. The package's published source code (dist/index.js) is a stub with all methods throwing "not implemented" errors — the real behaviour is in the obfuscated preinstall pipeline.
- analyzed by
- Leitwacht
- first seen
- Aug 4, 2026, 11:29 AM
- analyzed
- Aug 4, 2026, 11:44 AM
- weekly installs
- 146
Related advisories
- @servicetitan/marketing-direct-mail-components@20.1.5
- folder-lint@1.0.17
- editable-contracts@0.0.23
- @servicetitan/anvil2-ext-charts@0.2.8
- @servicetitan/titan-chatbot-ui-cypress@9.0.5
- @servicetitan/carto-charts-react@0.0.6
- @servicetitan/titan-chat-ui-anvil2@9.0.5
- @servicetitan/eh-module-communication@0.2.5
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.