registry / Malware / test-flow-entire6

test-flow-entire6

This report shows the evidence for test-flow-entire6@1.0.0. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

OpenSSF/OSV Malicious Advisory

imported 2mo ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-14320 confirms this npm version as malicious.

Advisory

MAL-2026-14320

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in test-flow-entire6 (npm)

Details

The package was found to contain malicious code or consuming dependency that contains malicious code ## Source: ghsa-malware (7a6e449e917229a86b7dc6a21bf7a7220d3837a1405f3f0b42bf49888b2fa8f4) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

OpenSSF/OSV advisory ADVISORY PACKAGE

Independent LPM AI assessment

Suspicious

Independent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.

The package is an inert metadata export, but its URL-pinned external dependency creates an unresolved supply-chain payload path. This supports a warning rather than a block.

Static reason

No blocking static signals were detected.

Trigger

npm install test-flow-entire6

Impact

The uninspected remotely supplied dependency can introduce install- or runtime-time code outside this package's reviewed source.

Mechanism

direct external dependency retrieval

AI rationale

The package is an inert metadata export, but its URL-pinned external dependency creates an unresolved supply-chain payload path. This supports a warning rather than a block.

Evidence

package.jsonnpm-shrinkwrap.jsonindex.jsREADME.md

Network endpoints1

artifacts.stg.yosiroute.com/npm/bundle-token-region-resolve

Independent scan evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Unknown with medium false-positive risk.

Evidence for AI warning decision

package.json declares a direct dependency fetched from a non-registry staging host.
npm-shrinkwrap.json locks bundle-token-region-resolve to that same external URL.

Evidence against

package.json has no lifecycle scripts.
index.js only exports static name and version metadata.
No executable, harvesting, shell, persistence, or network code exists in the package files.

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 73 B of source

Source & flagged code

1 flagged

package.jsonView file

•Published source reference

High

Suspicious Dependency Evidence

package.json declares a direct dependency fetched from a non-registry staging host.

package.jsonView on unpkg

Source & flagged code

1 flagged · loading source

package.jsonView file

•Published source reference

High

Suspicious Dependency Evidence

package.json declares a direct dependency fetched from a non-registry staging host.

package.jsonView on unpkg

Findings

2 High

HighSuspicious Dependency Evidencepackage.json

HighAi Review Evidence

Affected versions and remediation

This report applies to test-flow-entire6@1.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing test-flow-entire6@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-20 22:20:04.811Z (UTC).

Source advisory published: 2026-08-20 13:08:34.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

0.0.1-securitylatestClean—AllowPublishedAug 20, 2026, 1:07 PM 1.0.0shownMaliciousMalwareBlockPublishedJul 29, 2026, 10:26 PM

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Source & flagged code

Related packages

Other malware packages