CERT24MAL-2026-17849 — Malicious code in brass-common (npm)Loading data…
CERT24Threat Observatory
Period

MAL-2026-17849 — Malicious code in brass-common (npm)

The OpenSSF Package Analysis project identified npm package “brass-common” version 99.9.1 as malicious. The package uses a direct HTTPS tarball URL for the “ltidisafe” dependency, and installation may run lifecycle scripts contained in that tarball on the installer’s computer.

← Back to intelligence

MAL-2026-17849 — Malicious code in brass-common (npm)

The OpenSSF Package Analysis project identified npm package “brass-common” version 99.9.1 as malicious. The package uses a direct HTTPS tarball URL for the “ltidisafe” dependency, and installation may run lifecycle scripts contained in that tarball on the installer’s computer.