{"id":"MAL-2026-18357","summary":"Malicious code in csvflow-schema (npm)","details":"csvflow-schema is described as a \"Lightweight CSV column-schema validation helper\" (index.js exports a small validateSchema function) and adds a postinstall script that runs `node ./postinstall.js` on npm install. postinstall.js writes the username, hostname, working directory, parent process id and install path to `csvflow_schema/pi_2c75177b.ok` in the system temp directory, starts `calc.exe` through `cmd /c start`, and sends an HTTPS GET to `https://cdn-status.mulderitsme.net/pi/2c75177b`, a fixed-id install beacon. The npm account f0x_mulder published 1.0.0 on 2026-10-26, a minute after a 0.0.0-stage placeholder, and npm removed the package 17 minutes later.","modified":"2026-10-28T06:30:05.011304671Z","published":"2026-10-26T18:22:11Z","database_specific":{"iocs":{"domains":["cdn-status.mulderitsme.net"],"files":[{"digests":{"sha256":"369bc7bacef30f426e2136dc967b0ec207dbd84c88ab7460f3484d946025f5d6"},"note":"postinstall script runs `node ./postinstall.js`, which launches calc.exe and sends an install beacon to https://cdn-status.mulderitsme.net/pi/2c75177b (csvflow-schema@1.0.0).","paths":["package.json"],"source":"PACKAGE_ARCHIVE"},{"note":"Executed by the postinstall script of csvflow-schema@1.0.0.","paths":["postinstall.js"],"source":"PACKAGE_ARCHIVE","digests":{"sha256":"dc82f63b203b631c65ba8a5db185fb0136f5f49edead48fcc6673f19bc068b8b"}}],"urls":["https://cdn-status.mulderitsme.net/pi/2c75177b"]}},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/csvflow-schema"}],"affected":[{"package":{"name":"csvflow-schema","ecosystem":"npm","purl":"pkg:npm/csvflow-schema"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/csvflow-schema/MAL-2026-18357.json"}}],"schema_version":"1.9.2","credits":[{"name":"InvisiRisk, Inc.","contact":["https://www.invisirisk.com","mailto:research@invisirisk.com"],"type":"FINDER"}]}