MAL-2025-6894

--- _-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (e116400179d508d6dbe723a75f049d05218e1b019474bca84f2ed62537219572) commonweb-flow@7.999.999 declares its sole dependency `linker-event-header-serial` as a direct tarball URL on `artifacts.yosiroute.com` (not the npm registry), and npm-shrinkwrap.json marks that dependency with `hasInstallScript: true`. On `npm install`, npm fetches the tarball from `artifacts.yosiroute.com` and runs its lifecycle install scripts, giving that host arbitrary code execution on the installer's machine. The tarball contents at that URL are mutable and can be swapped server-side without republishing commonweb-flow. Package metadata is placeholder (`author: "Package Registry"`, `description: "Generated package"`, repository `github.com/example/commonweb-flow`), and the manifest version `7.999.999` is inflated relative to the README/index.js self-reported `1.0.0` — the shape of a dependency-confusion lure aimed at internal builds that resolve `commonweb-flow` from the public registry over an internal package of the same name.

## Source: ossf-package-analysis (0062bd72b843a0cab680d5655259ce9502b602bf366057232de9469f99b853e3) The OpenSSF Package Analysis project identified 'commonweb-flow' @ 10.11.0 (npm) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

- The package executes one or more commands associated with malicious behavior.