sn-flow-client

{"schema_version":"1.7.4","id":"MAL-2024-9443","published":"2024-10-21T14:56:36Z","modified":"2026-08-15T16:10:05.628040273Z","summary":"Malicious code in sn-flow-client (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d2c83ae0b3aa74be7de2508ec17549e3bc00e40edd30c62322e91be77ea48e69)\npackage.json declares a preinstall hook (\"preinstall\": \"node index.js\") that runs index.js automatically on npm install. index.js requires child_process, os, http, and https, then collects installer host identity — os.hostname(), process.platform, os.arch(), os.homedir(), os.userInfo() (username/uid/gid/shell), and the output of `whoami` / `id` / cwd via child_process — and POSTs the collected JSON to https://ypraooa298eigl12zisuxg2f76dx1npc.oastify.com/detox56. oastify.com is the Burp Collaborator out-of-band interaction domain; the random subdomain is an attacker-controlled OAST listener. The package has empty author/description/license metadata, no legitimate functionality, and a plausibly-internal-sounding name (sn-flow-client) — consistent with a dependency-confusion probe rather than a real client library. Installing this package causes immediate outbound transmission of installer host/user identifiers to an attacker-controlled endpoint with no user consent.\n\n## Source: ossf-package-analysis (40af2ecf250ffc74b1566c2e1b013c1fb2f8e1917dc5878511d1dbaf791c0c48)\nThe OpenSSF Package Analysis project identified 'sn-flow-client' @ 10.10.10 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"name":"sn-flow-client","ecosystem":"npm"},"versions":["10.10.10","20.5.1","1.0.2","1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"514e72418ccfda35b8bcc457b1a470858cb605fbe4f3e37a29e229803f05ed40","tlsh":"00514fd505f65a251ba7b8494a4f9402b227e1033605de55bfcc8340af9537c9bf0bf6"},{"path":"package.json","sha256":"7d67dd4d0fb1a41fe96543e0948d183ce40f6020eab6befd8470476e5f37ed4e","tlsh":"b5d0a7344e21653325c106a24c2ba487b3b18f2f04047c0863df582c81ee677a8ff31d"}],"package_integrity":[{"filename":"sn-flow-client-20.5.1.tgz","hashes":{"sha1":"15df11f96a1ba39b8a176a86c815aa695c1c200d","sha512_sri":"sha512-1LAEH6SCeVFfRqGeJm5yMAVkTwbPwSDegBzb2sSx1UOR1bF+fRdcsLe8rUCZGs/PuRBOjqDAS28otYzl1YYZ7Q=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/sn-flow-client/v/20.5.1"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sn-flow-client/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/sn-flow-client/v/1.0.1"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2024-10-21T15:05:44.825313176Z","modified_time":"2024-10-21T14:56:36Z","sha256":"40af2ecf250ffc74b1566c2e1b013c1fb2f8e1917dc5878511d1dbaf791c0c48","source":"ossf-package-analysis","versions":["10.10.10"]},{"id":"IN-MAL-2026-008165","import_time":"2026-07-08T17:40:19.199573892Z","modified_time":"2026-07-08T17:19:15Z","sha256":"d2c83ae0b3aa74be7de2508ec17549e3bc00e40edd30c62322e91be77ea48e69","source":"amazon-inspector","versions":["20.5.1"]},{"id":"IN-MAL-2026-014829","import_time":"2026-08-05T13:08:49.710911831Z","modified_time":"2026-08-05T12:58:13Z","sha256":"a1c1921e89e66f31a4af93624e4229cad611c90c038fbf3073bf59aeb21149c4","source":"amazon-inspector","versions":["1.0.2"]},{"id":"IN-MAL-2026-017961","import_time":"2026-08-15T16:07:56.777733293Z","modified_time":"2026-08-15T15:57:54Z","sha256":"81321dada19a5085305321684b951c430c6cef76e0c716729774c49eec53889e","source":"amazon-inspector","versions":["1.0.1"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}