Which versions of csvflow-schema are malicious?

The following npm versions of csvflow-schema are flagged malicious: 1.0.0. Treat any of these as compromised.

How do I remediate csvflow-schema if I installed it?

csvflow-schema establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.

I already installed csvflow-schema — how do I know if it already compromised me?

If csvflow-schema was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

How do I find csvflow-schema across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for csvflow-schema (version 1.0.0).

Malicious package

csvflow-schemanpm

Advisory published Oct 26, 2026Updated Oct 28, 2026

csvflow-schema is a confirmed malicious npm package (MAL-2026-18357) that opens a backdoor for remote access (malicious version 1.0.0). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in csvflow-schema (npm)

MAL-2026-18357

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall csvflow-schema

What this malware does

csvflow-schema is described as a "Lightweight CSV column-schema validation helper" (index.js exports a small validateSchema function) and adds a postinstall script that runs node ./postinstall.js on npm install. postinstall.js writes the username, hostname, working directory, parent process id and install path to csvflow_schema/pi_2c75177b.ok in the system temp directory, starts calc.exe through cmd /c start, and sends an HTTPS GET to https://cdn-status.mulderitsme.net/pi/2c75177b, a fixed-id install beacon. The npm account f0x_mulder published 1.0.0 on 2026-10-26, a minute after a 0.0.0-stage placeholder, and npm removed the package 17 minutes later.

Malicious versions

1 flagged

1.0.0

Detection & response playbook

Backdoor / remote access

Find it
Search your lockfiles and build artifacts for csvflow-schema (version 1.0.0).
If you installed it — respond
csvflow-schema establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.
Did it already run?
If csvflow-schema was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. csvflow-schema on npm has been identified as a malicious package (version 1.0.0 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

References

npmjs.com

Credits

InvisiRisk, Inc. · finder

Detect & block this

O3 blocks csvflow-schema-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database