Malicious code in @sourceflow-uk/sourceflow-tracker (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c5bcccc37c380ce54f5bfc2bc2311fbefb6ebc3400a397cbc4afc2188fb3c11d) package.json declares a dependency `ltidisafe` whose version specifier is the raw URL `https://storage.googleapis.com/lscunpentest/pack_ux_foundry.tgz` — a tarball hosted on a generic Google Cloud Storage bucket unrelated to the package's nominal publisher (@sourceflow-uk). On `npm install`, npm fetches and installs that tarball as a transitive dependency, executing any lifecycle scripts (preinstall/install/postinstall) it contains on the installer's machine. The URL is not version-pinned, not hash-verified, and not under the publisher's control: the bucket owner can swap the tarball contents at any time, so a future install delivers different bytes than a present install with no package change. The wrapper package itself is hollow — `index.js` only runs `console.log("hello from lslslslslss")`, the description is the garbled string `lspodcc`, the author is `lslsls`, and the version is `99.91.9`. These attributes are inconsistent with the advertised "sourceflow tracker" functionality and consistent with a throwaway lure whose sole purpose is to chain-load the third-party tarball into the installer's dependency tree. ## Source: ghsa-malware (e2c0d8ba218fdd8cf21875456495b5bc251a89f70737fec9a44416fda6f19ee7) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor
MAL-2026-5430
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-5430
@sourceflow-uk/sourceflow-tracker
Source reference: /affected/0/package/name
- Affected versions
- 99.91.9
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "SEMVER",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "@sourceflow-uk/sourceflow-tracker",
"purl": "pkg:npm/%40sourceflow-uk/sourceflow-tracker",
"ecosystem": "npm"
},
"versions": [
"99.91.9"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
},
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@sourceflow-uk/sourceflow-tracker/MAL-2026-5430.json",
"indicators": {
"domains": [
"storage.googleapis.com",
"10.201.176.2.ux-foundry.wwwz15e554m201wwajfl7m1ey54z1nq.oastify.com",
"7363616e2d386661393038626631316461.ux-foundry.wwwz15e554m201wwajfl7m1ey54z1nq.oastify.com",
"2f686f6d652f7363616e.ux-foundry.wwwz15e554m201wwajfl7m1ey54z1nq.oastify.com"
],
"evidence_files": [
{
"path": "package.json",
"tlsh": "39e0df28995255334bc942e64c257827eaa95e0e100c7c0947db212c49deab37dfa36c",
"sha256": "81ba01b776825d7bd6a7819f656074d826f3861e104328681a21506976f0d491"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "1740d0d60801b96daa36c0ff3373aeea56ce479b",
"sha512_sri": "sha512-tsfzUxVKmVCY02W9rN9HIXupUJjBXpiq1dZXNHHcLJ0ButH+05/Ckelw0P4WDrfBj6v481K00vNoa4cx0HqY2w=="
},
"filename": "sourceflow-tracker-99.91.9.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #10881 · Revision 1
- Added to Heist Feed
- Publisher date