{"id":"MAL-2026-18357","aliases":[],"title":"Malicious code in csvflow-schema (npm)","titleSource":"OSV","descriptionSource":"OSV","description":"csvflow-schema is described as a \"Lightweight CSV column-schema validation helper\" (index.js exports a small validateSchema function) and adds a postinstall script that runs `node ./postinstall.js` on npm install. postinstall.js writes the username, hostname, working directory, parent process id and install path to `csvflow_schema/pi_2c75177b.ok` in the system temp directory, starts `calc.exe` through `cmd /c start`, and sends an HTTPS GET to `https://cdn-status.mulderitsme.net/pi/2c75177b`, a fixed-id install beacon. The npm account f0x_mulder published 1.0.0 on 2026-10-26, a minute after a 0.0.0-stage placeholder, and npm removed the package 17 minutes later.","severity":"unknown","score":null,"published":"2026-10-26T18:22:11.000Z","modified":"2026-10-28T06:30:05.011Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"npm","name":"csvflow-schema","sources":[{"name":"OSV · MAL-2026-18357","url":"https://osv.dev/vulnerability/MAL-2026-18357"}],"ranges":[],"versions":["1.0.0"],"fixed":[]}],"sourceAffected":[],"references":["https://www.npmjs.com/package/csvflow-schema"],"sources":[{"name":"OSV","id":"MAL-2026-18357","modified":"2026-10-28T06:30:05.011304671Z","url":"https://osv.dev/vulnerability/MAL-2026-18357"}],"assessments":[],"products":[],"remediation":[],"kev":{"status":"unavailable","checkedAt":"2026-10-28T15:45:31.007Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}