Critical Malicious Code Vulnerability in @flexmr/survey-conversation Package
Summary
MAL-2026-17899: Malicious code in @flexmr/survey-conversation (npm). Affects @flexmr/survey-conversation versions 1.0.0 – 3.0.12. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @flexmr/survey-conversation package is an npm library designed for facilitating survey conversations. It is intended to streamline the process of gathering user feedback through interactive surveys. However, this package has been found to contain a significant security vulnerability that exposes users to potential malicious code execution.
Vulnerability Detail
The vulnerability originates from the package.json file, which declares its sole dependency as a bare HTTPS URL instead of a registry version range. This allows npm to fetch and execute any code served from that URL without integrity checks or version pinning. As a result, if an attacker gains control of the external host (artifacts.creditslib.com), they can alter the code delivered to users, leading to potential malicious activities on the installer's machine. This poses a severe risk as the behavior of the package is entirely dependent on the external code, which can change without notice.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @flexmr/survey-conversationIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the @flexmr/survey-conversation package until a secure version is released. If you must use it, consider implementing strict network policies to restrict access to the external URL, or use a local version of the dependency if possible.
Conclusion
The @flexmr/survey-conversation package has a critical vulnerability that allows for the execution of malicious code due to its reliance on an external URL for dependencies. Users are advised to update to a patched version as soon as it is available and to consider temporary workarounds to mitigate risks until then.
See every vulnerability recorded for @flexmr/survey-conversation →
FAQ
The main issue is that it fetches code from an external URL without integrity checks, which can lead to the execution of malicious code.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
You should update the package to the latest patched version as soon as it becomes available and consider implementing network restrictions as a temporary measure.
The consequences include the risk of executing malicious code on users' machines, which can lead to data breaches, unauthorized access, and other security incidents.
Yes, always ensure that dependencies are fetched from trusted sources, use version pinning, and implement security audits for your packages regularly.
