@vaultflow/create-flow @1.0.2

Summary

On require/import, the package's main module performs an HTTPS fetch to https://api.github.com/gists/198a0bbec7a6018e9250615d26e37b90 (a gist owned by third-party account 'getchainverse') and passes the returned file contents directly to eval(). The gist is mutable and controlled by an external account, so whatever code that account places in the gist is executed in the installer's Node.js process each time the package is loaded. There is no pinning, integrity check, or scoping — the executed payload can perform any action available to the Node.js process, including credential and environment access, filesystem reads/writes, and outbound network traffic.

Source: amazon-inspector (427ce4e703502549a51bc970efc1001b50680261cf55483c4eb1ac7569f61d48)