Skip to main content
MalwarePublished Updated

commonweb-flow (npm) · Malicious Code

Affects commonweb-flowSource GCVE Database

0

Malicious package : remove commonweb-flow and rotate any secrets on hosts that installed it.

Data as of 7 Aug 2026, 07:32 UTC

Classification

Malicious package

Published to npm · OSV MAL-2025-6894

What to do

Remove commonweb-flow from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

ProductAffectedFixed in
npmcommonweb-flowAffected
  • =10.11.0
  • =10.14.0
  • =10.12.0
  • =10.15.0
  • =10.13.0
  • =7.3.999
  • =7.1.999
  • =5.8.999
  • =7.2.999
  • =99.99.99
  • =5.999.999
  • =6.0.999
  • =7.999.999
  • =1.0.0
  • =6.999.999
Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'commonweb-flow' contains malicious code that executes arbitrary commands and communicates with a domain linked to malicious activity. Certain versions of this package declare a dependency hosted outside the npm registry, which runs install scripts from a mutable tarball, enabling remote code execution during installation. The package metadata appears to be a dependency-confusion lure, potentially targeting internal builds that mistakenly fetch this malicious public package.

References

Community reviews

Loading reviews…