MAL-2025-6894 Malicious code in commonweb-flow (npm)

[email protected] declares its sole dependency linker-event-header-serial as a direct tarball URL on artifacts.yosiroute.com (not the npm registry), and npm-shrinkwrap.json marks that dependency with hasInstallScript: true. On npm install, npm fetches the tarball from artifacts.yosiroute.com and runs its lifecycle install scripts, giving that host arbitrary code execution on the installer's machine. The tarball contents at that URL are mutable and can be swapped server-side without republishing commonweb-flow. Package metadata is placeholder (author: "Package Registry", description: "Generated package", repository github.com/example/commonweb-flow), and the manifest version 7.999.999 is inflated relative to the README/index.js self-reported 1.0.0 — the shape of a dependency-confusion lure aimed at internal builds that resolve commonweb-flow from the public registry over an internal package of the same name.

The OpenSSF Package Analysis project identified 'commonweb-flow' @ 10.11.0 (npm) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.

• The package executes one or more commands associated with malicious behavior.