commonweb-flow

commonweb-flow@7.999.999 declares its sole dependency `linker-event-header-serial` as a direct tarball URL on `artifacts.yosiroute.com` (not the npm registry), and npm-shrinkwrap.json marks that dependency with `hasInstallScript: true`. On `npm install`, npm fetches the tarball from `artifacts.yosiroute.com` and runs its lifecycle install scripts, giving that host arbitrary code execution on the installer's machine. The tarball contents at that URL are mutable and can be swapped server-side without republishing commonweb-flow. Package metadata is placeholder (`author: "Package Registry"`, `description: "Generated package"`, repository `github.com/example/commonweb-flow`), and the manifest version `7.999.999` is inflated relative to the README/index.js self-reported `1.0.0` — the shape of a dependency-confusion lure aimed at internal builds that resolve `commonweb-flow` from the public registry over an internal package of the same name. ## Source: ossf-package-analysis (0062bd72b843a0cab680d5655259ce9502b602bf366057232de9469f99b853e3) The OpenSSF Package Analysis project identified 'commonweb-flow' @ 10.11.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.