⌘ + K

MAL-2025-6894

Dashboard / Malicious Package / MAL-2025-6894

MAL-2025-6894

Published: 17 Aug 2025Last Modified: 6 Aug 2026

Summary: Malicious code in commonweb-flow (npm)

Details: Source: amazon-inspector (e116400179d508d6dbe723a75f049d05218e1b019474bca84f2ed62537219572) [email protected] declares its sole dependency `linker-event-header-serial` as a direct tarball URL on `artifacts.yosiroute.com` (not the npm registry), and npm-shrinkwrap.json marks that dependency with `hasInstallScript: true`. On `npm install`, npm fetches the tarball from `artifacts.yosiroute.com` and runs its lifecycle install scripts, giving that host arbitrary code execution on the installer's machine. The tarball contents at that URL are mutable and can be swapped server-side without republishing commonweb-flow. Package metadata is placeholder (`author: "Package Registry"`, `description: "Generated package"`, repository `github.com/example/commonweb-flow`), and the manifest version `7.999.999` is inflated relative to the README/index.js self-reported `1.0.0` — the shape of a dependency-confusion lure aimed at internal builds that resolve `commonweb-flow` from the public registry over an internal package of the same name. Source: ossf-package-analysis (0062bd72b843a0cab680d5655259ce9502b602bf366057232de9469f99b853e3) The OpenSSF Package Analysis project identified 'commonweb-flow' @ 10.11.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.

Affected packages

Package

Name: commonweb-flow

Purl: pkg:npm/commonweb-flow

Affected ranges

Type: N/A

Events:

Introduced- None

Fixed -None

Affected versions

10.11.0