MAL-2026-17879
Malicious code in @flexmr/ui (npm)
Published Oct 13, 2026 · updated Oct 15, 2026
runs , , and during installation. These lifecycle scripts send the package name, lifecycle event, a fixed token, and host identity details to and encode the hostname in a DNS query under , probing whether a build resolves the package from the public npm registry; it was published on 2026-10-13.
Timeline
Detection, updates, and resolution for this record.
Oct 13, 2026 · OSV.dev
Detected
runs , , and during installation. These lifecycle scripts send the package name, lifecycle event, a fixed token, and host identity details to and encode the hostname in a DNS query under , probing whether a build resolves the package from the public npm registry; it was published on 2026-10-13.
Oct 15, 2026 · OSV.dev
Updated
runs , , and during installation. These lifecycle scripts send the package name, lifecycle event, a fixed token, and host identity details to and encode the hostname in a DNS query under , probing whether a build resolves the package from the public npm registry; it was published on 2026-10-13.
Affected
- npm @flexmr/ui99.99.99