{"id":"MAL-2026-17899","revision":"9a55b9e8f1d74971a8717647b4687c45","records":[{"revision":"9a55b9e8f1d74971a8717647b4687c45","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17899","aliases":[],"title":"Malicious code in @flexmr/survey-conversation (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (20ab57dd6ac5a0eafc23934f6e715064453641bc57a549050f1d2e66a7630374)\npackage.json declares its sole dependency `cache-format-syntax-tracer` as a bare HTTPS URL (`https://artifacts.creditslib.com/npm/cache-format-syntax-tracer`) rather than a registry version range. On `npm install`, npm fetches whatever bytes that host serves and executes any lifecycle scripts inside, with no version pin, no registry integrity check, and no hash. The shipped `index.js` is a one-line re-export of that dependency, so runtime behavior is also fully delegated to the externally-hosted bytes. Whoever controls `artifacts.creditslib.com` controls code on every installer's machine, and the content can change between installs without any change to this package. The package is published under the `@flexmr` scope with placeholder author/publisher metadata (`example/@flexmr/...`, `Package Registry`), consistent with a dependency-confusion lure targeting an internal `@flexmr` package name.\n","state":0,"publishedAt":"2026-10-16T06:55:02+00:00","modifiedAt":"2026-10-16T07:15:08.9586324+00:00","affected":[{"ecosystem":"npm","name":"@flexmr/survey-conversation","ranges":[],"versions":["1.0.12","10.0.12","2.0.12","1.0.0","3.0.12"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/@flexmr/survey-conversation/v/1.0.12","https://www.npmjs.com/package/@flexmr/survey-conversation/v/10.0.12","https://www.npmjs.com/package/@flexmr/survey-conversation/v/2.0.12","https://www.npmjs.com/package/@flexmr/survey-conversation/v/1.0.0","https://www.npmjs.com/package/@flexmr/survey-conversation/v/3.0.12"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17899","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17899","identifiers":["MAL-2026-17899"]},"retained":false,"historicalAffected":[]}],"coverage":[]}