npm · Malicious package advisory
Malware@flexmr/utils
MAL-2026-17888
Malicious code in @flexmr/utils (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (7039d72eee8d5f1abdc19889f0712d38273fd988a32aee832fc651712e386c52) @flexmr/[email protected] ships a one-line re-export stub whose package.json declares its sole dependency `daemon-thread-lookup-buffer` via a direct HTTPS URL to a non-registry host: `https://artifacts.creditslib.com/npm/daemon-thread-lookup-buffer`. The dependency is unpinned, carries no integrity hash, and is not resolved through the npm registry. On `npm install`, npm fetches whatever bytes that host returns and installs them as a package, executing any lifecycle scripts (`preinstall`/`install`/`postinstall`) contained in that artifact; the shipped index.js then re-exports the fetched module so `require('@flexmr/utils')` also loads its code. The manifest further exhibits dependency-confusion shape: the `@flexmr/*` scope with placeholder metadata (author `Package Registry`, generic description, example.com repository) suggests a package intended to shadow an internal name during resolution. Control of install-time and import-time code execution on the installer's host rests entirely with the operator of `artifacts.creditslib.com`. ## Source: ossf-package-analysis (fc751fb286e3a288e498adfc3b9b936c1ff40270a1c342047a7d778ce24936f4) The OpenSSF Package Analysis project identified '@flexmr/utils' @ 3.0.12 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior.
Compromised versions (5)
- 1.0.0
- 3.0.12
- 1.0.12
- 10.0.12
- 2.0.12
Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.