{"id":"MAL-2026-18357","kind":"package","aliases":["MAL-2026-18357"],"related":[],"title":"Malicious code in csvflow-schema (npm)","description":"csvflow-schema is described as a \"Lightweight CSV column-schema validation helper\" (index.js exports a small validateSchema function) and adds a postinstall script that runs `node ./postinstall.js` on npm install. postinstall.js writes the username, hostname, working directory, parent process id and install path to `csvflow_schema/pi_2c75177b.ok` in the system temp directory, starts `calc.exe` through `cmd /c start`, and sends an HTTPS GET to `https://cdn-status.mulderitsme.net/pi/2c75177b`, a fixed-id install beacon. The npm account f0x_mulder published 1.0.0 on 2026-10-26, a minute after a 0.0.0-stage placeholder, and npm removed the package 17 minutes later.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"csvflow-schema","fixed":[],"affected":"= 1.0.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-26T18:22:11+00:00","first_seen_at":"2026-10-28T07:01:41+00:00","triaged_at":"2026-10-28T07:03:38+00:00","updated_at":"2026-10-28T07:07:01+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-10':102C '-18357':10A,13A '-2026':9A,12A '-26':103C '/c':76C '/pi/2c75177b':86C '/postinstall.js':47C '0.0.0':108C '1.0.0':99C '17':116C '2026':101C 'account':95C 'add':40C 'beacon':92C 'calc.exe':73C 'cdn-status.mulderitsme.net':85C 'cdn-status.mulderitsme.net/pi/2c75177b':84C 'cmd':75C 'code':2A 'column':29C 'column-schema':28C 'csv':27C 'csvflow':5A,15A,20C,65C 'csvflow-schema':4A,14A,19C 'describ':23C 'directori':57C,71C 'export':34C 'f0x':96C 'fix':89C 'fixed-id':88C 'function':38C 'get':82C 'helper':32C 'hostnam':55C 'https':81C 'id':60C,90C 'index.js':33C 'instal':50C,62C,91C 'later':118C 'lightweight':26C 'mal':8A,11A 'malici':1A,17B 'minut':105C,117C 'mulder':97C 'node':46C 'npm':7A,49C,94C,112C 'packag':18B,115C 'parent':58C 'path':63C 'placehold':110C 'postinstal':42C 'postinstall.js':51C 'process':59C 'publish':98C 'remov':113C 'run':45C 'schema':6A,16A,21C,30C 'schema/pi_2c75177b.ok':66C 'script':43C 'send':79C 'small':36C 'stage':109C 'start':72C,77C 'system':69C 'temp':70C 'usernam':54C 'valid':31C 'validateschema':37C 'work':56C 'write':52C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-26T18:22:11+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18357","url":"https://osv.dev/vulnerability/MAL-2026-18357","severity":"critical","published_at":"2026-10-26T18:22:11+00:00","modified_at":"2026-10-28T06:30:05+00:00","first_seen_at":"2026-10-28T07:01:41+00:00","fetched_at":"2026-10-28T07:01:41+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}