registry / @fleetbo/svro / 0.0.14

@fleetbo/svro@0.0.14

OSV Malicious Advisory

scanned 2h ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-14586 confirms this npm version as malicious. Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Advisory

MAL-2026-14586

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in @fleetbo/svro (npm)

Details

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Decision reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

References

OSV advisory ADVISORY

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

NoLicense

scanned 7 file(s), 39.9 KB of source, external domains: sendemailotp-jqycakhlxa-uc.a.run.app, verifyemailotp-jqycakhlxa-uc.a.run.app

Source & flagged code

8 flagged

package.jsonView file

•scripts.postinstall = node ./dist/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./dist/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/postinstall.jsView file

1#!/usr/bin/env node L2: var I=(t,n)=>()=>{try{return n||t((n={exports:{}}).exports,n),n.exports}catch(o){throw n=0,o}};var j=I((L,_)=>{var a=require("fs"),p=require("path");function i(t){console.log(` ${... L3: `),i(`\u2192 ${p.basename(r)} ${s?"cr\xE9\xE9":"mis \xE0 jour"} : checkJs/jsx/types configur\xE9s.`),i(' \u26A0\uFE0F Rechargez votre \xE9diteur si les changements ne sont pas pr... ... L22: const path = require('path'); L23: const { execSync } = require('child_process'); L24: const schemaPath = path.join(process.cwd(), 'svro.schema.json'); L25: fs.writeFileSync(schemaPath, JSON.stringify(schema, null, 2) + '\\n'); ... L28: res.writeHead(200, { 'Content-Type': 'application/json' }); L29: res.end(JSON.stringify({ success: true })); L30: } catch (e) { ... L40: },`+s.slice(c)}}i

Critical

Credential Exfiltration

Source appears to send environment or credential material to an external endpoint.

dist/postinstall.jsView on unpkg · L1

25fs.writeFileSync(schemaPath, JSON.stringify(schema, null, 2) + '\\n'); L26: execSync('npx fleetbo sql sync', { stdio: 'ignore' }); L27: } L28: res.writeHead(200, { 'Content-Type': 'application/json' }); L29: res.end(JSON.stringify({ success: true })); L30: } catch (e) { ... L40: },`+s.slice(c)}}if(s!==r)try{a.writeFileSync(l,s),i(`\u2192 ${p.basename(l)} patch\xE9 : plugins AutoImport & Fleetbo Schema Sync configur\xE9s.`)}catch{i("\u2192 \xC9chec de l'\xE... L41: `),i("\u2192 package.json mis \xE0 jour : unplugin-auto-import ajout\xE9 aux devDependencies."),i(" \u26A0\uFE0F Relancez `npm install` une fois pour installer le paquet ajout\xE... L42: VITE_FLEETBO_DB_KEY=${e.dbKey}

Critical

Command Output Exfiltration

Source executes local commands and sends command output to an external endpoint.

dist/postinstall.jsView on unpkg · L25

22const path = require('path'); L23: const { execSync } = require('child_process'); L24: const schemaPath = path.join(process.cwd(), 'svro.schema.json');

High

Child Process

Package source references child process execution.

dist/postinstall.jsView on unpkg · L22

25fs.writeFileSync(schemaPath, JSON.stringify(schema, null, 2) + '\\n'); L26: execSync('npx fleetbo sql sync', { stdio: 'ignore' }); L27: } ... L40: },`+s.slice(c)}}if(s!==r)try{a.writeFileSync(l,s),i(`\u2192 ${p.basename(l)} patch\xE9 : plugins AutoImport & Fleetbo Schema Sync configur\xE9s.`)}catch{i("\u2192 \xC9chec de l'\xE... L41: `),i("\u2192 package.json mis \xE0 jour : unplugin-auto-import ajout\xE9 aux devDependencies."),i(" \u26A0\uFE0F Relancez `npm install` une fois pour installer le paquet ajout\xE... L42: VITE_FLEETBO_DB_KEY=${e.dbKey}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/postinstall.jsView on unpkg · L25

25fs.writeFileSync(schemaPath, JSON.stringify(schema, null, 2) + '\\n'); L26: execSync('npx fleetbo sql sync', { stdio: 'ignore' }); L27: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/postinstall.jsView on unpkg · L25

dist/cli.cjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @fleetbo/svro@0.0.12 matchedIdentity = npm:QGZsZWV0Ym8vc3Zybw:0.0.12 similarity = 0.714 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.cjsView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./dist/postinstall.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./dist/postinstall.cjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/postinstall.jsView file

Findings

3 Critical5 High4 Medium6 Low

CriticalCredential Exfiltrationdist/postinstall.js

CriticalCommand Output Exfiltrationdist/postinstall.js

CriticalPrevious Version Dangerous Deltadist/cli.cjs

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/postinstall.js

HighShell

HighSame File Env Network Executiondist/postinstall.js

HighRuntime Package Installdist/postinstall.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts