csvflow-schema (npm): malicious postinstall beacon package removed from registry
Severity: critical · Patch status: no-fix-needed · Since 2026-10-28
The npm package csvflow-schema, published as version 1.0.0 on 2026-10-26 by account f0xmulder, contained malicious code flagged by OpenSSF and recorded in the GitHub Advisory Database (GHSA-mhx4-6f72-5vf7, CWE-506). While posing as a lightweight CSV column-schema validation helper, its postinstall script ran on npm install, wrote host details (username, hostname, working directory, parent PID, install path) to a marker file in the temp directory, launched calc.exe, and sent an HTTPS GET install beacon to cdn-status.mulderitsme.net. Only version 1.0.0 is affected; npm removed the package 17 minutes after publication. There is no patched version — anyone who installed it should treat the machine as compromised.
What to do
- Check lockfiles and installed node_modules for csvflow-schema@1.0.0 and remove it
- If installed, rebuild/reimage the affected machine and rotate credentials accessible from it
- Inspect temp directory for csvflow_schema/pi_2c75177b.ok and review network logs for cdn-status.mulderitsme.net
- Block the beacon domain cdn-status.mulderitsme.net at egress
- Audit recent npm installs and CI caches for the package
Sources
All live incidents on Threat Watch
