Malicious code in csvflow-schema (npm)

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

csvflow-schema is described as a "Lightweight CSV column-schema validation helper" (index.js exports a small validateSchema function) and adds a postinstall script that runs `node ./postinstall.js` on npm install. postinstall.js writes the username, hostname, working directory, parent process id and install path to `csvflow_schema/pi_2c75177b.ok` in the system temp directory, starts `calc.exe` through `cmd /c start`, and sends an HTTPS GET to `https://cdn-status.mulderitsme.net/pi/2c75177b`, a fixed-id install beacon. The npm account f0x_mulder published 1.0.0 on 2026-10-26, a minute after a 0.0.0-stage placeholder, and npm removed the package 17 minutes later. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (e9875c39a2aa68e4b0e18354d0fb7063c02f449d6f1f6b3c420f812cec979351) csvflow-schema advertises itself as a CSV schema helper but ships a postinstall.js that, on npm install, unconditionally spawns calc.exe via `cmd /c start` and performs an HTTPS GET to the hardcoded non-publisher host cdn-status.mulderitsme.net with a per-install identifier path (/pi/2c75177b). The script also collects local identity data (os.userInfo().username, os.hostname(), process.cwd(), ppid) into a temp file. The code execution primitive (arbitrary child_process spawn at install time) and the callback to a hardcoded third-party host unrelated to any CSV functionality are consistent with a dropper or PoC that proves arbitrary code execution and network reachability on the installer. The declared package purpose (CSV schema helper) has no need for child_process, calculator invocation, or beaconing to an external domain.

Source published

26 Oct 2026 18:22:11 UTC

Source modified

29 Oct 2026 13:30:04 UTC

Observed here

29 Oct 2026 14:12:32 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.