Threats Tagged 'mal-2026-5430'

The npm package @sourceflow-uk/sourceflow-tracker version 99.91.9 is a malicious package that includes a dependency fetched from an uncontrolled external URL. This dependency is a tarball hosted on a generic Google Cloud Storage bucket unrelated to the package publisher, allowing the bucket owner to change its contents arbitrarily. The package itself is hollow and appears to be a lure to chain-load the external malicious tarball. Installing this package executes lifecycle scripts from the external tarball, potentially compromising the host system. Any system with this package installed should be considered fully compromised, and all stored secrets and keys should be rotated immediately from a different machine.