{"id":"MAL-2026-17888","summary":"Malicious code in @flexmr/utils (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (7039d72eee8d5f1abdc19889f0712d38273fd988a32aee832fc651712e386c52)\n@flexmr/utils@3.0.12 ships a one-line re-export stub whose package.json declares its sole dependency `daemon-thread-lookup-buffer` via a direct HTTPS URL to a non-registry host: `https://artifacts.creditslib.com/npm/daemon-thread-lookup-buffer`. The dependency is unpinned, carries no integrity hash, and is not resolved through the npm registry. On `npm install`, npm fetches whatever bytes that host returns and installs them as a package, executing any lifecycle scripts (`preinstall`/`install`/`postinstall`) contained in that artifact; the shipped index.js then re-exports the fetched module so `require('@flexmr/utils')` also loads its code. The manifest further exhibits dependency-confusion shape: the `@flexmr/*` scope with placeholder metadata (author `Package Registry`, generic description, example.com repository) suggests a package intended to shadow an internal name during resolution. Control of install-time and import-time code execution on the installer's host rests entirely with the operator of `artifacts.creditslib.com`.\n\n## Source: ossf-package-analysis (fc751fb286e3a288e498adfc3b9b936c1ff40270a1c342047a7d778ce24936f4)\nThe OpenSSF Package Analysis project identified '@flexmr/utils' @ 3.0.12 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package executes one or more commands associated with malicious behavior.\n","modified":"2026-10-16T07:15:08.447231752Z","published":"2026-10-14T03:01:21Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-10-15T20:16:27.919047828Z","modified_time":"2026-10-14T03:05:54Z","sha256":"ccf04862b6c4575628dc879f9582eb1a359f1b50522eed7372847de34caa2825","source":"ossf-package-analysis","versions":["1.0.0"]},{"sha256":"fc751fb286e3a288e498adfc3b9b936c1ff40270a1c342047a7d778ce24936f4","source":"ossf-package-analysis","versions":["3.0.12"],"import_time":"2026-10-15T20:16:28.109788525Z","modified_time":"2026-10-14T03:01:21Z"},{"versions":["1.0.12"],"id":"IN-MAL-2026-021477","import_time":"2026-10-16T06:57:50.428105049Z","modified_time":"2026-10-16T06:54:17Z","sha256":"2139ea79c95c31b7af43813b4da54fd77118a9feb95507a6b0f4ea100aa45bba","source":"amazon-inspector"},{"import_time":"2026-10-16T06:57:50.309225431Z","modified_time":"2026-10-16T06:53:58Z","sha256":"35ff92c173e50691a6373ff7110fffff7302bb3e04ca7b7d6551a7da3509f794","source":"amazon-inspector","versions":["1.0.0"],"id":"IN-MAL-2026-021475"},{"sha256":"7039d72eee8d5f1abdc19889f0712d38273fd988a32aee832fc651712e386c52","source":"amazon-inspector","versions":["3.0.12"],"id":"IN-MAL-2026-021478","import_time":"2026-10-16T06:57:50.488550595Z","modified_time":"2026-10-16T06:54:30Z"},{"source":"amazon-inspector","versions":["10.0.12"],"id":"IN-MAL-2026-021473","import_time":"2026-10-16T06:57:50.18022015Z","modified_time":"2026-10-16T06:53:38Z","sha256":"9271828ff4b85b9193975436457cbc3306c41b06f91231ff9e0b1bc5752dbaf5"},{"source":"amazon-inspector","versions":["2.0.12"],"id":"IN-MAL-2026-021476","import_time":"2026-10-16T06:57:50.366511057Z","modified_time":"2026-10-16T06:54:08Z","sha256":"e812bfea910580a60615c4bcf22939a29dfed8c7ecb01cefda27c921af1971d2"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@flexmr/utils/v/1.0.12"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@flexmr/utils/v/1.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@flexmr/utils/v/3.0.12"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@flexmr/utils/v/10.0.12"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/@flexmr/utils/v/2.0.12"}],"affected":[{"package":{"name":"@flexmr/utils","ecosystem":"npm","purl":"pkg:npm/%40flexmr/utils"},"versions":["1.0.0","3.0.12","1.0.12","10.0.12","2.0.12"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@flexmr/utils/MAL-2026-17888.json","indicators":{"evidence_files":[{"tlsh":"dde02b354920a82317c81bd85c69158776130c07950cec6667d2727e95df6a358fd35c","path":"package.json","sha256":"8eef78b04a4f9da2fd1cd45eff5fc346dbb70e40af4501e49f90d2a424361c94"}],"package_integrity":[{"filename":"utils-1.0.12.tgz","hashes":{"sha1":"f174588c2e81d634f8c8a3b052649de1a88689fe","sha512_sri":"sha512-6JkmDx+aAcJEF1aXoZjaAHP7QMNohvNQhd1bpNSDzMwUWIskwD9K7jTyKgDDXDA0iy3smLZcOwQ+QPDyxZMTyQ=="}}]}}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}