MAL-2026-17888

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@flexmr/utils/MAL-2026-17888.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17888
Published
2026-10-14T03:01:21Z
Modified
2026-10-16T07:15:08Z
Summary
Malicious code in @flexmr/utils (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (7039d72eee8d5f1abdc19889f0712d38273fd988a32aee832fc651712e386c52)

@flexmr/utils@3.0.12 ships a one-line re-export stub whose package.json declares its sole dependency daemon-thread-lookup-buffer via a direct HTTPS URL to a non-registry host: https://artifacts.creditslib.com/npm/daemon-thread-lookup-buffer. The dependency is unpinned, carries no integrity hash, and is not resolved through the npm registry. On npm install, npm fetches whatever bytes that host returns and installs them as a package, executing any lifecycle scripts (preinstall/install/postinstall) contained in that artifact; the shipped index.js then re-exports the fetched module so require('@flexmr/utils') also loads its code. The manifest further exhibits dependency-confusion shape: the @flexmr/* scope with placeholder metadata (author Package Registry, generic description, example.com repository) suggests a package intended to shadow an internal name during resolution. Control of install-time and import-time code execution on the installer's host rests entirely with the operator of artifacts.creditslib.com.

Source: ossf-package-analysis (fc751fb286e3a288e498adfc3b9b936c1ff40270a1c342047a7d778ce24936f4)

The OpenSSF Package Analysis project identified '@flexmr/utils' @ 3.0.12 (npm) as malicious.

It is considered malicious because:

  • The package executes one or more commands associated with malicious behavior.
Database specific 
{
    "malicious-packages-origins":  [
        {
            "import_time":  "2026-10-15T20:16:27.919047828Z",
            "modified_time":  "2026-10-14T03:05:54Z",
            "sha256":  "ccf04862b6c4575628dc879f9582eb1a359f1b50522eed7372847de34caa2825",
            "source":  "ossf-package-analysis",
            "versions":  [
                "1.0.0"
            ]
        },
        {
            "import_time":  "2026-10-15T20:16:28.109788525Z",
            "modified_time":  "2026-10-14T03:01:21Z",
            "sha256":  "fc751fb286e3a288e498adfc3b9b936c1ff40270a1c342047a7d778ce24936f4",
            "source":  "ossf-package-analysis",
            "versions":  [
                "3.0.12"
            ]
        },
        {
            "id":  "IN-MAL-2026-021477",
            "import_time":  "2026-10-16T06:57:50.428105049Z",
            "modified_time":  "2026-10-16T06:54:17Z",
            "sha256":  "2139ea79c95c31b7af43813b4da54fd77118a9feb95507a6b0f4ea100aa45bba",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.12"
            ]
        },
        {
            "id":  "IN-MAL-2026-021475",
            "import_time":  "2026-10-16T06:57:50.309225431Z",
            "modified_time":  "2026-10-16T06:53:58Z",
            "sha256":  "35ff92c173e50691a6373ff7110fffff7302bb3e04ca7b7d6551a7da3509f794",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-021478",
            "import_time":  "2026-10-16T06:57:50.488550595Z",
            "modified_time":  "2026-10-16T06:54:30Z",
            "sha256":  "7039d72eee8d5f1abdc19889f0712d38273fd988a32aee832fc651712e386c52",
            "source":  "amazon-inspector",
            "versions":  [
                "3.0.12"
            ]
        },
        {
            "id":  "IN-MAL-2026-021473",
            "import_time":  "2026-10-16T06:57:50.18022015Z",
            "modified_time":  "2026-10-16T06:53:38Z",
            "sha256":  "9271828ff4b85b9193975436457cbc3306c41b06f91231ff9e0b1bc5752dbaf5",
            "source":  "amazon-inspector",
            "versions":  [
                "10.0.12"
            ]
        },
        {
            "id":  "IN-MAL-2026-021476",
            "import_time":  "2026-10-16T06:57:50.366511057Z",
            "modified_time":  "2026-10-16T06:54:08Z",
            "sha256":  "e812bfea910580a60615c4bcf22939a29dfed8c7ecb01cefda27c921af1971d2",
            "source":  "amazon-inspector",
            "versions":  [
                "2.0.12"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / @flexmr/utils

Package

Name
@flexmr/utils
View open source insights on deps.dev
Purl
pkg:npm/%40flexmr/utils

Affected ranges

Affected versions

1.*
1.0.0
1.0.12
2.*
2.0.12
3.*
3.0.12
10.*
10.0.12

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "package.json",
            "sha256":  "8eef78b04a4f9da2fd1cd45eff5fc346dbb70e40af4501e49f90d2a424361c94",
            "tlsh":  "dde02b354920a82317c81bd85c69158776130c07950cec6667d2727e95df6a358fd35c"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "utils-1.0.12.tgz",
            "hashes":  {
                "sha1":  "f174588c2e81d634f8c8a3b052649de1a88689fe",
                "sha512_sri":  "sha512-6JkmDx+aAcJEF1aXoZjaAHP7QMNohvNQhd1bpNSDzMwUWIskwD9K7jTyKgDDXDA0iy3smLZcOwQ+QPDyxZMTyQ=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@flexmr/utils/MAL-2026-17888.json"