Experiments
Stop when this page is not the decision
A published page can record a stop. It does not, by itself, record the next plan.
github.com published this account (2026-10-25): GitHub published 8 malware advisories between 2026-10-25T15:31:36Z and 2026-10-25T15:31:37Z for npm: @jm-telefonica/multibrand-components 99.9.1; @postex/common 99.9.1; @generic-means/ing-feat-scanner-libs 99.9.1; @factoryz/apollo 99.9.1; @futurae-public/adaptive-js 99.9.1; @fmr-ap153177/apex-kit-icons 99.9.1; sc-hydrate-carousel-price 99.9.1; paychex-pdftron 99.9.1. Per the GitHub advisories (source: amazon-inspector), each package ships an empty stub and declares a single dependency ltidisafe resolved from a bare HTTPS tarball URL on ltidi.storage.googleapis.com, so installing it fetches attacker-controlled code. No known-good version named. CVE pending (none assigned). Exploitation: NOT STATED. Primary source: OPENED_AND_SUPPORTS / Event time: 2026-10-25T15:31:36Z / Security record: GHSA-xrpm-2w69-j2r7, GHSA-cxq5-px5q-3gm4, GHSA-3qv7-4fg6-54gp, GHSA-8wg4-rwxf-cv7v, GHSA-79qp-32qv-632x, GHSA-vw9v-ghxv-m2gw, GHSA-p6gr-jpmq-4hjq, GHSA-qg7g-2jr4-vjw8 / Fixed release: none yet / Discovery confidence: High
This guide uses that public page as the example. This site did not run the test, close the deal, or measure the product.
Write only what the page says
The page's claim is: GitHub published 8 malware advisories between 2026-10-25T15:31:36Z and 2026-10-25T15:31:37Z for npm: @jm-telefonica/multibrand-components 99.9.1; @postex/common 99.9.1; @generic-means/ing-feat-scanner-libs 99.9.1; @factoryz/apollo 99.9.1; @futurae-public/adaptive-js 99.9.1; @fmr-ap153177/apex-kit-icons 99.9.1; sc-hydrate-carousel-price 99.9.1; paychex-pdftron 99.9.1. Per the GitHub advisories (source: amazon-inspector), each package ships an empty stub and declares a single dependency ltidisafe resolved from a bare HTTPS tarball URL on ltidi.storage.googleapis.com, so installing it fetches attacker-controlled code. No known-good version named. CVE pending (none assigned). Exploitation: NOT STATED. Primary source: OPENED_AND_SUPPORTS / Event time: 2026-10-25T15:31:36Z / Security record: GHSA-xrpm-2w69-j2r7, GHSA-cxq5-px5q-3gm4, GHSA-3qv7-4fg6-54gp, GHSA-8wg4-rwxf-cv7v, GHSA-79qp-32qv-632x, GHSA-vw9v-ghxv-m2gw, GHSA-p6gr-jpmq-4hjq, GHSA-qg7g-2jr4-vjw8 / Fixed release: none yet / Discovery confidence: High
Put the URL under that sentence. If a later recap adds a number or a date, keep the original page as the record.
A published page can record a stop. It does not, by itself, record the next plan.
Do the site's check on this one page. Fill a line only when the page supports it. Where the page is silent, write Not stated.
A finished note names the page, the date, and the limit of the claim. It does not borrow a result from a different story.
Stop at the untested line
Anything you did not open, install, or count stays untested. Leave that line visible.
Source page: Malicious npm dependency-confusion packages pulling the ltidisafe tarball (GitHub malware advisories GHSA-xrpm-2w69-j2r7 and 7 more).