MAL-2026-17899
Malicious code in @flexmr/survey-conversation (npm)
Published Oct 16, 2026 · updated Oct 16, 2026
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (20ab57dd6ac5a0eafc23934f6e715064453641bc57a549050f1d2e66a7630374) package.json declares its sole dependency as a bare HTTPS URL ( ) rather than a registry version range. On , npm fetches whatever bytes that host serves and executes any lifecycle scripts inside, with no version pin, no registry integrity check, and no hash. The shipped is a one-line re-export of that dependency, so runtime behavior is also fully delegated to the externally-hosted bytes. Whoever controls controls code on every installer's machine, and the content can change between installs without any change to this package. The package is published under the scope with placeholder author/publisher metadata ( , ), consistent with a dependency-confusion lure targeting an internal package name.
Code
The project this record applies to. Exploit listings stay in References.
Timeline
Detection, updates, and resolution for this record.
Oct 16, 2026 · OSV.dev
Detected
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (20ab57dd6ac5a0eafc23934f6e715064453641bc57a549050f1d2e66a7630374) package.json declares its sole dependency as a bare HTTPS URL ( ) rather than a registry version range. On , npm fetches whatever bytes that host serves and executes any lifecycle scripts inside, with no version pin, no registry integrity check,
Oct 16, 2026 · OSV.dev
Updated
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (20ab57dd6ac5a0eafc23934f6e715064453641bc57a549050f1d2e66a7630374) package.json declares its sole dependency as a bare HTTPS URL ( ) rather than a registry version range. On , npm fetches whatever bytes that host serves and executes any lifecycle scripts inside, with no version pin, no registry integrity check,
Affected
- npm @flexmr/survey-conversation1.0.12, 10.0.12, 2.0.12