registry / Malware / test-flow-1

test-flow-1

This report shows the evidence for test-flow-1@1.0.2. 2 of 3 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

OpenSSF/OSV Malicious Advisory

imported 2mo ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-14319 confirms this npm version as malicious.

Advisory

MAL-2026-14319

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in test-flow-1 (npm)

Details

The package was found to contain malicious code or consuming dependency that contains malicious code ## Source: ghsa-malware (905871518a56d8e3e0eb1d82a9321c853cbe3457bc846ef48e7cd01abe55daed) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

OpenSSF/OSV advisory ADVISORY PACKAGE PACKAGE

Independent LPM AI assessment

Suspicious

Independent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.

The package itself is inert, but its direct external dependency is uninspected and lacks lockfile integrity evidence. This is an unresolved staged-payload supply-chain risk, not confirmed malicious code.

Static reason

No blocking static signals were detected.

Trigger

npm install test-flow-1

Impact

The externally hosted dependency could introduce unreviewed install- or runtime behavior.

Mechanism

direct URL dependency fetch

AI rationale

Evidence

package.jsonnpm-shrinkwrap.jsonindex.jsREADME.md

Network endpoints1

artifacts.stg.yosiroute.com/npm/schema-format-memo-index

Independent scan evidence

public snapshot

AI called this Suspicious at 80.0% confidence as Unknown with medium false-positive risk.

Evidence for AI warning decision

package.json declares schema-format-memo-index from a direct external artifact URL.
npm-shrinkwrap.json resolves that dependency without an integrity hash.
Package and shrinkwrap/source versions disagree (1.0.2 vs 1.0.0).

Evidence against

package.json has no lifecycle scripts.
index.js only exports static name and version metadata.
No source reads files, environment, credentials, or invokes network/shell code.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 67 B of source

Source & flagged code

1 flagged

package.jsonView file

•Published source reference

High

Ai Review Evidence

package.json declares schema-format-memo-index from a direct external artifact URL.

package.jsonView on unpkg

Source & flagged code

1 flagged · loading source

package.jsonView file

•Published source reference

High

Ai Review Evidence

package.json declares schema-format-memo-index from a direct external artifact URL.

package.jsonView on unpkg

Findings

3 High

HighAi Review Evidencepackage.json

HighSuspicious Dependency Evidence

HighAi Review Evidence

Affected versions and remediation

This report applies to test-flow-1@1.0.2.

The versions list below shows the verdict for each recorded version.

Avoid installing test-flow-1@1.0.2. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-20 22:40:06.322Z (UTC).

Source advisory published: 2026-08-20 13:08:34.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

3 known versions

0.0.1-securitylatestClean—AllowPublishedAug 20, 2026, 1:07 PM 1.0.2shownMaliciousMalwareBlockPublishedJul 30, 2026, 1:24 AM 1.0.0MaliciousMalwareBlockPublishedJul 30, 2026, 1:19 AM

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Source & flagged code

Related packages

Other malware packages