{"id":"MAL-2026-17888","revision":"8db5804ebbd244278872be02b0ad5384","records":[{"revision":"8db5804ebbd244278872be02b0ad5384","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17888","aliases":[],"title":"Malicious code in @flexmr/utils (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7039d72eee8d5f1abdc19889f0712d38273fd988a32aee832fc651712e386c52)\n@flexmr/utils@3.0.12 ships a one-line re-export stub whose package.json declares its sole dependency `daemon-thread-lookup-buffer` via a direct HTTPS URL to a non-registry host: `https://artifacts.creditslib.com/npm/daemon-thread-lookup-buffer`. The dependency is unpinned, carries no integrity hash, and is not resolved through the npm registry. On `npm install`, npm fetches whatever bytes that host returns and installs them as a package, executing any lifecycle scripts (`preinstall`/`install`/`postinstall`) contained in that artifact; the shipped index.js then re-exports the fetched module so `require('@flexmr/utils')` also loads its code. The manifest further exhibits dependency-confusion shape: the `@flexmr/*` scope with placeholder metadata (author `Package Registry`, generic description, example.com repository) suggests a package intended to shadow an internal name during resolution. Control of install-time and import-time code execution on the installer's host rests entirely with the operator of `artifacts.creditslib.com`.\n\n## Source: ossf-package-analysis (fc751fb286e3a288e498adfc3b9b936c1ff40270a1c342047a7d778ce24936f4)\nThe OpenSSF Package Analysis project identified '@flexmr/utils' @ 3.0.12 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n","state":0,"publishedAt":"2026-10-14T03:01:21+00:00","modifiedAt":"2026-10-16T07:15:08.4472318+00:00","affected":[{"ecosystem":"npm","name":"@flexmr/utils","ranges":[],"versions":["1.0.0","3.0.12","1.0.12","10.0.12","2.0.12"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/@flexmr/utils/v/1.0.12","https://www.npmjs.com/package/@flexmr/utils/v/1.0.0","https://www.npmjs.com/package/@flexmr/utils/v/3.0.12","https://www.npmjs.com/package/@flexmr/utils/v/10.0.12","https://www.npmjs.com/package/@flexmr/utils/v/2.0.12"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17888","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17888","identifiers":["MAL-2026-17888"]},"retained":false,"historicalAffected":[]}],"coverage":[]}