registry / Malware / test-flow-entire7

test-flow-entire7

This report shows the evidence for test-flow-entire7@1.0.0. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

OpenSSF/OSV Malicious Advisory

imported 2mo ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-14321 confirms this npm version as malicious.

Advisory

MAL-2026-14321

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in test-flow-entire7 (npm)

Details

The package was found to contain malicious code or consuming dependency that contains malicious code ## Source: ghsa-malware (e40dc014c5f24a73d365158edaf778378d02e8b7a441f489eda64721874e75c8) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

References

OpenSSF/OSV advisory ADVISORY PACKAGE

Independent LPM AI assessment

Suspicious

Independent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.

No concrete malicious payload is present in the extracted top-level source, but the externally hosted install-script dependency creates unresolved install-time execution risk. This warrants a warning rather than a block.

Static reason

No blocking static signals were detected.

Trigger

npm install test-flow-entire7

Impact

Unresolved install-time code execution from the external artifact host.

Mechanism

remote dependency lifecycle-script execution

AI rationale

Evidence

package.jsonnpm-shrinkwrap.jsonindex.jsREADME.md

Network endpoints1

artifacts.stg.yosiroute.com/npm/batch-sender-script-kernel

Independent scan evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for AI warning decision

package.json declares dependency from artifacts.stg.yosiroute.com
npm-shrinkwrap.json marks that dependency hasInstallScript: true
Installing this package can fetch and execute the dependency lifecycle script

Evidence against

package.json has no package lifecycle scripts
index.js only exports static name and version
No credential access, shell execution, or network code exists in the shipped entrypoint

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

Trivial

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 73 B of source

Source & flagged code

1 flagged

package.jsonView file

•Published source reference

High

Suspicious Dependency Evidence

package.json declares dependency from artifacts.stg.yosiroute.com

package.jsonView on unpkg

Source & flagged code

1 flagged · loading source

package.jsonView file

•Published source reference

High

Suspicious Dependency Evidence

package.json declares dependency from artifacts.stg.yosiroute.com

package.jsonView on unpkg

Findings

3 High

HighSuspicious Dependency Evidencepackage.json

HighSuspicious Dependency Evidence

HighSuspicious Lifecycle Evidence

Affected versions and remediation

This report applies to test-flow-entire7@1.0.0.

The versions list below shows the verdict for each recorded version.

Avoid installing test-flow-entire7@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-08-20 22:40:06.322Z (UTC).

Source advisory published: 2026-08-20 13:08:34.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

0.0.1-securitylatestClean—AllowPublishedAug 20, 2026, 1:07 PM 1.0.0shownMaliciousMalwareBlockPublishedJul 30, 2026, 2:01 AM

OpenSSF/OSV Malicious Advisory

Independent LPM AI assessment

Independent scan evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other malware packages

Source & flagged code

Related packages

Other malware packages