Malicious code in @flexmr/utils (npm)
Exact source revision recorded 24 Oct 2026 13:17:17 UTC. It does not establish the source's current position. Latest evidence.
osv · MAL-2026-17888
Published--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (7039d72eee8d5f1abdc19889f0712d38273fd988a32aee832fc651712e386c52) @flexmr/[email protected] ships a one-line re-export stub whose package.json declares its sole dependency `daemon-thread-lookup-buffer` via a direct HTTPS URL to a non-registry host: `https://artifacts.creditslib.com/npm/daemon-thread-lookup-buffer`. The dependency is unpinned, carries no integrity hash, and is not resolved through the npm registry. On `npm install`, npm fetches whatever bytes that host returns and installs them as a package, executing any lifecycle scripts (`preinstall`/`install`/`postinstall`) contained in that artifact; the shipped index.js then re-exports the fetched module so `require('@flexmr/utils')` also loads its code. The manifest further exhibits dependency-confusion shape: the `@flexmr/*` scope with placeholder metadata (author `Package Registry`, generic description, example.com repository) suggests a package intended to shadow an internal name during resolution. Control of install-time and import-time code execution on the installer's host rests entirely with the operator of `artifacts.creditslib.com`. ## Source: ossf-package-analysis (fc751fb286e3a288e498adfc3b9b936c1ff40270a1c342047a7d778ce24936f4) The OpenSSF Package Analysis project identified '@flexmr/utils' @ 3.0.12 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.
- Source published
- 14 Oct 2026 03:01:21 UTC
- Source modified
- 16 Oct 2026 07:15:08 UTC
- Observed here
- 24 Oct 2026 13:17:17 UTC
- Source terms
- OSV · upstream source license applies
Original source record · Cite this exact observation · Complete original publisher JSON
This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.