Malicious code in commonweb-flow (npm)
The npm package 'commonweb-flow' contains malicious code that executes arbitrary commands and communicates with a domain linked to malicious activity. Certain versions of this package declare a dependency hosted outside the npm registry, which runs install scripts from a mutable tarball, enabling remote code execution during installation. The package metadata appears to be a dependency-confusion lure, potentially targeting internal builds that mistakenly fetch this malicious public package.
AI Analysis
Technical Summary
The 'commonweb-flow' npm package versions including 1.0.0, 5.8.999, 5.999.999, 6.0.999, 6.999.999, 7.1.999, 7.2.999, 7.3.999, 7.999.999, 10.11.0, 10.12.0, 10.13.0, 10.14.0, 10.15.0, and 99.99.99 are identified as malicious. The package declares a direct tarball dependency from a non-npm domain (artifacts.yosiroute.com) that contains install scripts executed during npm install, allowing arbitrary code execution on the installer's machine. The tarball contents are mutable and can be changed server-side without republishing the package, increasing risk. The package metadata is minimal and appears designed to lure internal builds into resolving this malicious package instead of an internal one. Additionally, the package communicates with domains associated with malicious activity and executes commands linked to malicious behavior.
Potential Impact
Installing affected versions of 'commonweb-flow' can lead to arbitrary code execution on the installer's machine due to lifecycle scripts in a dependency fetched from an untrusted, mutable tarball URL. This can compromise the security and integrity of the development environment or production systems where the package is installed. The malicious package also communicates with known malicious domains, potentially enabling data exfiltration or further compromise.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing any versions of 'commonweb-flow' listed as affected. Verify dependencies and avoid packages that declare dependencies from untrusted external URLs. Monitor package sources carefully to prevent dependency confusion attacks. Check vendor advisories or trusted security sources for updates or official guidance.
Malicious code in commonweb-flow (npm)
Description
The npm package 'commonweb-flow' contains malicious code that executes arbitrary commands and communicates with a domain linked to malicious activity. Certain versions of this package declare a dependency hosted outside the npm registry, which runs install scripts from a mutable tarball, enabling remote code execution during installation. The package metadata appears to be a dependency-confusion lure, potentially targeting internal builds that mistakenly fetch this malicious public package.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'commonweb-flow' npm package versions including 1.0.0, 5.8.999, 5.999.999, 6.0.999, 6.999.999, 7.1.999, 7.2.999, 7.3.999, 7.999.999, 10.11.0, 10.12.0, 10.13.0, 10.14.0, 10.15.0, and 99.99.99 are identified as malicious. The package declares a direct tarball dependency from a non-npm domain (artifacts.yosiroute.com) that contains install scripts executed during npm install, allowing arbitrary code execution on the installer's machine. The tarball contents are mutable and can be changed server-side without republishing the package, increasing risk. The package metadata is minimal and appears designed to lure internal builds into resolving this malicious package instead of an internal one. Additionally, the package communicates with domains associated with malicious activity and executes commands linked to malicious behavior.
Potential Impact
Installing affected versions of 'commonweb-flow' can lead to arbitrary code execution on the installer's machine due to lifecycle scripts in a dependency fetched from an untrusted, mutable tarball URL. This can compromise the security and integrity of the development environment or production systems where the package is installed. The malicious package also communicates with known malicious domains, potentially enabling data exfiltration or further compromise.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should avoid installing any versions of 'commonweb-flow' listed as affected. Verify dependencies and avoid packages that declare dependencies from untrusted external URLs. Monitor package sources carefully to prevent dependency confusion attacks. Check vendor advisories or trusted security sources for updates or official guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2025-6894
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["npm"]
Threat ID: 6a7573b5bf8831d539d93bb8
Added to database: 08/07/2026, 05:57:09 UTC
Last enriched: 08/07/2026, 07:32:30 UTC
Last updated: 09/08/2026, 22:03:33 UTC
Views: 50
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.