npm · Malicious package advisory
Malware@flowselections/core
MAL-2026-4390
Malicious code in @flowselections/core (npm)
Details
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (b28cf238827c035b4f3103aff9bf803421b7d16d1c7877d7e74c5fcd71f3283b)
The package exports a `supabase` client and `LoginPage` component wired to a hardcoded Supabase URL (`https://vmicscahrnzpmhagztmx.supabase.co`) and anon key with no env-var or prop override. In `dist/supabase/client.js` the URL is a literal constant, and `dist/components/layout/LoginPage.js` calls `supabase.auth.signInWithPassword({ email, password })` against that client. Any consumer that integrates the advertised `LoginPage`, `useAuth`, or `supabase` exports to gate access to their own application will silently send their end-users' email/password credentials, sign-up data, and profile reads/writes to the author-controlled Supabase tenant rather than the consumer's own backend. There is no documented opt-out or configuration surface. This is the silent-relay shape: caller-supplied data flows through the package's public API to a destination hardcoded by the author.
Compromised versions (2)
- 1.0.8
- 1.0.9
Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.