Your RSA-2048 keys break in 2030. Find every one of them before attackers do.
Malicious package

@library-wide/library-shellnpm

Advisory published Updated

@library-wide/library-shell is a confirmed malicious npm package (MAL-2026-17754) that executes malicious code on install (malicious version 99.9.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in @library-wide/library-shell (npm)

MAL-2026-17754
Immediate action
Remove the package, then rotate any secrets the build/runtime could reach.
npm uninstall @library-wide/library-shell

What this malware does

package.json declares the sole dependency 'ltidisafe' as a direct HTTPS tarball URL (https://ltidi.storage.googleapis.com/depenconf/ltidisafe-3.8.4.tgz) rather than a registry version range, with no integrity hash and no version pin. The shipped index.js is an empty stub, so the manifest is the entire published surface: on npm install, the tarball at that URL is fetched and installed, and any lifecycle scripts inside it execute on the installer's machine. Whoever controls that bucket path controls the code that runs. The package name 'library-shell' and scope '@library-wide' do not correspond to any functional code in the tarball, consistent with a lure whose only purpose is to pull in the off-registry dependency.

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

The OpenSSF Package Analysis project identified '@library-wide/library-shell' @ 99.9.1 (npm) as malicious.

It is considered malicious because:

  • The package communicates with a domain associated with malicious activity.

Malicious versions

1 flagged
99.9.1

Indicators of compromise (SHA-256)

40f52e7af5c6b8f0c78b5100b561b799fc6acd9fa9c5372982a14bb5c1b42da1
35fe912c705e73aff92ef85fb3de7bf49ebaf1bd6e5736b963aeb1bcd66c2a0b
08ae76e41cbd6797f41f2858531cfadd13b6122ff07a219e43097d467f52b13a

Detection & response playbook

Malicious package

  1. Find it

    Search your lockfiles and build artifacts for @library-wide/library-shell (version 99.9.1).

  2. If you installed it — respond

    Remove @library-wide/library-shell from your project and lockfile, then assume any secrets accessible to the build or runtime were exposed: rotate API keys, tokens, and credentials, and audit for unexpected outbound activity or persistence.

  3. Did it already run?

    If @library-wide/library-shell was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. @library-wide/library-shell on npm has been identified as a malicious package (version 99.9.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-021447GHSA-8j36-pr5c-f6vx

References

Credits

  • Amazon Inspector · finder
  • OpenSSF: Package Analysis · finder

Detect & block this

O3 blocks @library-wide/library-shell-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the malicious outbound activity and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database
@library-wide/library-shell (npm) malicious package — MAL-2026-17754 | O3 Security