MAL-2026-18357

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/csvflow-schema/MAL-2026-18357.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18357
Published
2026-10-26T18:22:11Z
Modified
2026-10-28T06:30:05Z
Summary
Malicious code in csvflow-schema (npm)
Details

csvflow-schema is described as a "Lightweight CSV column-schema validation helper" (index.js exports a small validateSchema function) and adds a postinstall script that runs node ./postinstall.js on npm install. postinstall.js writes the username, hostname, working directory, parent process id and install path to csvflow_schema/pi_2c75177b.ok in the system temp directory, starts calc.exe through cmd /c start, and sends an HTTPS GET to https://cdn-status.mulderitsme.net/pi/2c75177b, a fixed-id install beacon. The npm account f0x_mulder published 1.0.0 on 2026-10-26, a minute after a 0.0.0-stage placeholder, and npm removed the package 17 minutes later.

Database specific 
{
    "iocs":  {
        "domains":  [
            "cdn-status.mulderitsme.net"
        ],
        "files":  [
            {
                "digests":  {
                    "sha256":  "369bc7bacef30f426e2136dc967b0ec207dbd84c88ab7460f3484d946025f5d6"
                },
                "note":  "postinstall script runs `node ./postinstall.js`, which launches calc.exe and sends an install beacon to https://cdn-status.mulderitsme.net/pi/2c75177b (csvflow-schema@1.0.0).",
                "paths":  [
                    "package.json"
                ],
                "source":  "PACKAGE_ARCHIVE"
            },
            {
                "digests":  {
                    "sha256":  "dc82f63b203b631c65ba8a5db185fb0136f5f49edead48fcc6673f19bc068b8b"
                },
                "note":  "Executed by the postinstall script of csvflow-schema@1.0.0.",
                "paths":  [
                    "postinstall.js"
                ],
                "source":  "PACKAGE_ARCHIVE"
            }
        ],
        "urls":  [
            "https://cdn-status.mulderitsme.net/pi/2c75177b"
        ]
    }
}
References
Credits

Affected packages

npm / csvflow-schema

Package

Name
csvflow-schema
View open source insights on deps.dev
Purl
pkg:npm/csvflow-schema

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/csvflow-schema/MAL-2026-18357.json"