{"schema_version":"1.9.2","id":"MAL-2026-18357","published":"2026-10-26T18:22:11Z","modified":"2026-10-29T13:30:04.725611161Z","summary":"Malicious code in csvflow-schema (npm)","details":"csvflow-schema is described as a \"Lightweight CSV column-schema validation helper\" (index.js exports a small validateSchema function) and adds a postinstall script that runs `node ./postinstall.js` on npm install. postinstall.js writes the username, hostname, working directory, parent process id and install path to `csvflow_schema/pi_2c75177b.ok` in the system temp directory, starts `calc.exe` through `cmd /c start`, and sends an HTTPS GET to `https://cdn-status.mulderitsme.net/pi/2c75177b`, a fixed-id install beacon. The npm account f0x_mulder published 1.0.0 on 2026-10-26, a minute after a 0.0.0-stage placeholder, and npm removed the package 17 minutes later.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (e9875c39a2aa68e4b0e18354d0fb7063c02f449d6f1f6b3c420f812cec979351)\ncsvflow-schema advertises itself as a CSV schema helper but ships a postinstall.js that, on npm install, unconditionally spawns calc.exe via `cmd /c start` and performs an HTTPS GET to the hardcoded non-publisher host cdn-status.mulderitsme.net with a per-install identifier path (/pi/2c75177b). The script also collects local identity data (os.userInfo().username, os.hostname(), process.cwd(), ppid) into a temp file. The code execution primitive (arbitrary child_process spawn at install time) and the callback to a hardcoded third-party host unrelated to any CSV functionality are consistent with a dropper or PoC that proves arbitrary code execution and network reachability on the installer. The declared package purpose (CSV schema helper) has no need for child_process, calculator invocation, or beaconing to an external domain.\n","affected":[{"package":{"name":"csvflow-schema","ecosystem":"npm","purl":"pkg:npm/csvflow-schema"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"postinstall.js","sha256":"dc82f63b203b631c65ba8a5db185fb0136f5f49edead48fcc6673f19bc068b8b","tlsh":"de1152f743cd577872524a83930359265d9bc1432b80a6f4f76801523fc927c0a63cf5"}],"package_integrity":[{"filename":"csvflow-schema-1.0.0.tgz","hashes":{"sha1":"bce61df4ed4af38552d725de8b9cdfb044884198","sha512_sri":"sha512-demTBPCN0EVlQfgONYEGweaQUUOOA+Q19U3PNETki/fqUg4KD2Pg2LGlTVvL/9/aKWoe9GJlGoFBPjQSC9Sh5w=="}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/csvflow-schema/MAL-2026-18357.json"}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/csvflow-schema"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/csvflow-schema/v/1.0.0"}],"database_specific":{"iocs":{"domains":["cdn-status.mulderitsme.net"],"files":[{"digests":{"sha256":"369bc7bacef30f426e2136dc967b0ec207dbd84c88ab7460f3484d946025f5d6"},"note":"postinstall script runs `node ./postinstall.js`, which launches calc.exe and sends an install beacon to https://cdn-status.mulderitsme.net/pi/2c75177b (csvflow-schema@1.0.0).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"digests":{"sha256":"dc82f63b203b631c65ba8a5db185fb0136f5f49edead48fcc6673f19bc068b8b"},"note":"Executed by the postinstall script of csvflow-schema@1.0.0.","paths":["postinstall.js"],"source":"PACKAGE_ARCHIVE"}],"urls":["https://cdn-status.mulderitsme.net/pi/2c75177b"]},"malicious-packages-origins":[{"id":"IN-MAL-2026-021830","import_time":"2026-10-29T13:14:06.447143177Z","modified_time":"2026-10-29T13:13:19Z","sha256":"e9875c39a2aa68e4b0e18354d0fb7063c02f449d6f1f6b3c420f812cec979351","source":"amazon-inspector","versions":["1.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}