MAL-2025-6894

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/commonweb-flow/MAL-2025-6894.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2025-6894

Published

2025-08-17T11:40:41Z

Modified

2026-08-06T23:50:07Z

Summary

Malicious code in commonweb-flow (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e116400179d508d6dbe723a75f049d05218e1b019474bca84f2ed62537219572)

commonweb-flow@7.999.999 declares its sole dependency linker-event-header-serial as a direct tarball URL on artifacts.yosiroute.com (not the npm registry), and npm-shrinkwrap.json marks that dependency with hasInstallScript: true. On npm install, npm fetches the tarball from artifacts.yosiroute.com and runs its lifecycle install scripts, giving that host arbitrary code execution on the installer's machine. The tarball contents at that URL are mutable and can be swapped server-side without republishing commonweb-flow. Package metadata is placeholder (author: "Package Registry", description: "Generated package", repository github.com/example/commonweb-flow), and the manifest version 7.999.999 is inflated relative to the README/index.js self-reported 1.0.0 — the shape of a dependency-confusion lure aimed at internal builds that resolve commonweb-flow from the public registry over an internal package of the same name.

Source: ossf-package-analysis (0062bd72b843a0cab680d5655259ce9502b602bf366057232de9469f99b853e3)

The OpenSSF Package Analysis project identified 'commonweb-flow' @ 10.11.0 (npm) as malicious.

It is considered malicious because:

The package communicates with a domain associated with malicious activity.
The package executes one or more commands associated with malicious behavior.

Database specific

{
    "malicious-packages-origins": [
        {
            "import_time": "2025-08-17T12:09:34.703644367Z",
            "modified_time": "2025-08-17T11:40:41Z",
            "sha256": "0062bd72b843a0cab680d5655259ce9502b602bf366057232de9469f99b853e3",
            "source": "ossf-package-analysis",
            "versions": [
                "10.11.0"
            ]
        },
        {
            "import_time": "2025-08-17T13:39:32.252171071Z",
            "modified_time": "2025-08-17T13:30:55Z",
            "sha256": "5bcd8577706d27ca6cc5252f85e422508cda0b5d6bda71ea5df868bca41c8a6f",
            "source": "ossf-package-analysis",
            "versions": [
                "10.14.0"
            ]
        },
        {
            "import_time": "2025-08-17T13:39:32.147893047Z",
            "modified_time": "2025-08-17T13:14:33Z",
            "sha256": "d9b58be14f6055e5d3650c12e54f16ecde2ff0ba9c8587d272b918c4277229ff",
            "source": "ossf-package-analysis",
            "versions": [
                "10.12.0"
            ]
        },
        {
            "import_time": "2025-08-17T15:36:02.520090251Z",
            "modified_time": "2025-08-17T15:28:34Z",
            "sha256": "04684d4086c4313003ed0e06c85458352f5ca435bf592fd6001b90e4c67911a7",
            "source": "ossf-package-analysis",
            "versions": [
                "10.15.0"
            ]
        },
        {
            "import_time": "2025-08-18T06:09:46.728370718Z",
            "modified_time": "2025-08-17T13:27:04Z",
            "sha256": "bdc5595e1f21ceb733d6e936051dec79d1b46e18698930b33b7eb6f6dba7ddbd",
            "source": "ossf-package-analysis",
            "versions": [
                "10.13.0"
            ]
        },
        {
            "id": "IN-MAL-2026-016706",
            "import_time": "2026-08-06T18:09:08.890131201Z",
            "modified_time": "2026-08-06T16:27:50Z",
            "sha256": "3c5fee00c8d8c3cf5f6caac853392e3b514f4eb82b2cc45e8a3e52bc381b0523",
            "source": "amazon-inspector",
            "versions": [
                "7.3.999"
            ]
        },
        {
            "id": "IN-MAL-2026-016708",
            "import_time": "2026-08-06T18:09:09.170148989Z",
            "modified_time": "2026-08-06T16:28:51Z",
            "sha256": "469d3048080e379125d121adb4fc041b0b37fb0f52f4ca0d9d8c243b2c134114",
            "source": "amazon-inspector",
            "versions": [
                "7.1.999"
            ]
        },
        {
            "id": "IN-MAL-2026-016710",
            "import_time": "2026-08-06T18:09:09.407251715Z",
            "modified_time": "2026-08-06T16:33:51Z",
            "sha256": "dc1d6f97961c2f3d72f3517914a0b48ce1a0e0a9a449802c28391a71a8ab9a10",
            "source": "amazon-inspector",
            "versions": [
                "5.8.999"
            ]
        },
        {
            "id": "IN-MAL-2026-016707",
            "import_time": "2026-08-06T18:09:09.018902737Z",
            "modified_time": "2026-08-06T16:28:00Z",
            "sha256": "175f96f7b6e528c0dd0d28d14f1d38d98e1be928ed6cef84ad11a54b04694b18",
            "source": "amazon-inspector",
            "versions": [
                "7.2.999"
            ]
        },
        {
            "id": "IN-MAL-2026-016666",
            "import_time": "2026-08-06T18:09:03.301689125Z",
            "modified_time": "2026-08-06T16:14:55Z",
            "sha256": "a18ec07b1b3b6d69d628b180b0de1bdff6ba47f233392864581283a6305ff7fa",
            "source": "amazon-inspector",
            "versions": [
                "99.99.99"
            ]
        },
        {
            "id": "IN-MAL-2026-016713",
            "import_time": "2026-08-06T18:09:09.888958016Z",
            "modified_time": "2026-08-06T16:34:20Z",
            "sha256": "a6f05daa5f51d4a63e9461b29c3cc3a224ac09378e11eb1f09ae00e0a27cc8f0",
            "source": "amazon-inspector",
            "versions": [
                "5.999.999"
            ]
        },
        {
            "id": "IN-MAL-2026-016712",
            "import_time": "2026-08-06T18:09:09.684430559Z",
            "modified_time": "2026-08-06T16:34:10Z",
            "sha256": "ad3636aaffaf4f15c191a2052a1a7f0afdd0bad2c17594e49f1013f4e9e3ab91",
            "source": "amazon-inspector",
            "versions": [
                "6.0.999"
            ]
        },
        {
            "id": "IN-MAL-2026-016705",
            "import_time": "2026-08-06T18:09:08.764127823Z",
            "modified_time": "2026-08-06T16:27:40Z",
            "sha256": "e116400179d508d6dbe723a75f049d05218e1b019474bca84f2ed62537219572",
            "source": "amazon-inspector",
            "versions": [
                "7.999.999"
            ]
        },
        {
            "id": "IN-MAL-2026-016711",
            "import_time": "2026-08-06T18:09:09.547956646Z",
            "modified_time": "2026-08-06T16:34:01Z",
            "sha256": "e94f68cb062c09a675b899a7932554c5913ff1e0466f9f0ae6d1d97da4e1aa7b",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "IN-MAL-2026-016709",
            "import_time": "2026-08-06T18:09:09.300879581Z",
            "modified_time": "2026-08-06T16:33:44Z",
            "sha256": "3a38588a53eae4c3aa491d5f9dc61d2cc6e2801cce35a33ad1b8800b950dd189",
            "source": "amazon-inspector",
            "versions": [
                "6.999.999"
            ]
        }
    ]
}

References

Credits

- Amazon Inspector - FINDER
- - actran@amazon.com
  - inspector-research@amazon.com
- OpenSSF: Package Analysis - FINDER
- - https://github.com/ossf/package-analysis
  - https://openssf.slack.com/channels/package_analysis

Affected packages

npm / commonweb-flow

Package

Name: commonweb-flow; View open source insights on deps.dev
Purl: pkg:npm/commonweb-flow

Affected ranges

Affected versions

1.*

1.0.0

5.*

5.8.999

5.999.999

6.*

6.0.999

6.999.999

7.*

7.1.999

7.2.999

7.3.999

7.999.999

10.*

10.11.0

10.12.0

10.13.0

10.14.0

10.15.0

99.*

99.99.99

Database specific

cwes

[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    },
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]

indicators

{
    "evidence_files": [
        {
            "path": "npm-shrinkwrap.json",
            "sha256": "2f0047728607d14fb839cbe99c597e4e8005f5cc0d0b7b7f845e895b78c2f9b8",
            "tlsh": "6cf0f0b1cca81eb321e823b4c13a59029660210b8d1c38ddfacc5c1d4fd8dab29a4708"
        }
    ],
    "package_integrity": [
        {
            "filename": "commonweb-flow-7.3.999.tgz",
            "hashes": {
                "sha1": "cee0fe7280f107f99020820d1a6423d6f4d82f43",
                "sha512_sri": "sha512-qYJcPPMlIQd4gifP7ow/n3wWer813HjLnfBa50rkaBEpuUmI9mEKvLa9Bx1HUCHHGWJevP+p73zaF9qmCUoCBQ=="
            }
        }
    ]
}

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/commonweb-flow/MAL-2025-6894.json"