MAL-2026-18357 Malicious code in csvflow-schema (npm)

csvflow-schema is described as a "Lightweight CSV column-schema validation helper" (index.js exports a small validateSchema function) and adds a postinstall script that runs node ./postinstall.js on npm install. postinstall.js writes the username, hostname, working directory, parent process id and install path to csvflow_schema/pi_2c75177b.ok in the system temp directory, starts calc.exe through cmd /c start, and sends an HTTPS GET to https://cdn-status.mulderitsme.net/pi/2c75177b, a fixed-id install beacon. The npm account f0x_mulder published 1.0.0 on 2026-10-26, a minute after a 0.0.0-stage placeholder, and npm removed the package 17 minutes later.

csvflow-schema advertises itself as a CSV schema helper but ships a postinstall.js that, on npm install, unconditionally spawns calc.exe via cmd /c start and performs an HTTPS GET to the hardcoded non-publisher host cdn-status.mulderitsme.net with a per-install identifier path (/pi/2c75177b). The script also collects local identity data (os.userInfo().username, os.hostname(), process.cwd(), ppid) into a temp file. The code execution primitive (arbitrary child_process spawn at install time) and the callback to a hardcoded third-party host unrelated to any CSV functionality are consistent with a dropper or PoC that proves arbitrary code execution and network reachability on the installer. The declared package purpose (CSV schema helper) has no need for child_process, calculator invocation, or beaconing to an external domain.