MAL-2026-18357: Malicious code in csvflow-schema (npm)

csvflow-schema is described as a "Lightweight CSV column-schema validation helper" (index.js exports a small validateSchema function) and adds a postinstall script that runs node ./postinstall.js on npm install. postinstall.js writes the username, hostname, working directory, parent process id and install path to csvflowschema/pi2c75177b.ok in the system temp directory, starts calc.exe through cmd /c start, and sends an HTTPS GET to https://cdn-status.mulderitsme.net/pi/2c75177b, a fixed-id install beacon. The npm account f0xmulder published 1.0.0 on 2026-10-26, a minute after a 0.0.0-stage placeholder, and npm removed the package 17 minutes later.

--- -= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e9875c39a2aa68e4b0e18354d0fb7063c02f449d6f1f6b3c420f812cec979351) csvflow-schema advertises itself as a CSV schema helper but ships a postinstall.js that, on npm install, unconditionally spawns calc.exe via cmd /c start and performs an HTTPS GET to the hardcoded non-publisher host cdn-status.mulderitsme.net with a per-install identifier path (/pi/2c75177b). The script also collects local identity data (os.userInfo().username, os.hostname(), process.cwd(), ppid) into a temp file. The code execution primitive (arbitrary childprocess spawn at install time) and the callback to a hardcoded third-party host unrelated to any CSV functionality are consistent with a dropper or PoC that proves arbitrary code execution and network reachability on the installer. The declared package purpose (CSV schema helper) has no need for childprocess, calculator invocation, or beaconing to an external domain.