MalwarePublished 21 Oct 2024Updated 5 Aug 2026

sn-flow-client (npm) · Malicious Code

Affects sn-flow-clientSource GCVE Database

What to do

Affected software

Product	Affected	Fixed in
npmsn-flow-client	Affected =10.10.10 =20.5.1 =1.0.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'sn-flow-client' versions 10.10.10, 20.5.1, and 1.0.2 contain malicious code that executes automatically upon installation. This code collects detailed host and user identity information and sends it to an attacker-controlled external domain without user consent. The package lacks legitimate functionality and appears designed for dependency confusion attacks or reconnaissance.

Impact

Installing the affected versions of 'sn-flow-client' results in unauthorized disclosure of sensitive host and user identity information to an attacker-controlled server. This compromises privacy and may facilitate further targeted attacks or reconnaissance by adversaries. There is no indication of additional payloads or direct system compromise beyond data exfiltration.

Defensive guidance

Users and organizations should avoid installing the 'sn-flow-client' package versions 10.10.10, 20.5.1, and 1.0.2. Review dependency trees to ensure this package is not included transitively. Monitor for and remove any instances of this package from projects.

Summary

The 'sn-flow-client' npm package declares a preinstall script that runs index.js during installation. This script collects system information including hostname, platform, architecture, home directory, user info, and command outputs such as 'whoami' and 'id'. It then sends this data as JSON to a malicious external endpoint hosted on an attacker-controlled Burp Collaborator domain. The package metadata is empty or misleading, indicating no legitimate purpose and suggesting it is used for malicious reconnaissance or dependency confusion attacks. The OpenSSF Package Analysis project identified this package as malicious based on its behavior and communication with a known malicious domain.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 5 Aug 2026, 17:01 UTC

Technical details

References

Community reviews