MAL-2026-16273

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/blue-string-formatter-utils/MAL-2026-16273.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16273
Published
2026-09-17T23:19:27Z
Modified
2026-09-18T01:00:06Z
Summary
Malicious code in blue-string-formatter-utils (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (aa3c9f5edcc636fc8d38e40a6bb225aed8f6b638be31f2abf8b6e747212c9565)

The package advertises itself as 'Utility helpers for string formatting' but its shipped main file performs a single behavior: an XMLHttpRequest GET to the protocol-relative URL //xss.report/c/k3rne111 whose response body is passed directly to eval(). Any require()/import of this package causes arbitrary attacker-controlled JavaScript from xss.report to execute in the consumer's Node process, with no pinning, no integrity check, and no relationship to the advertised functionality. The mismatch between the package's stated purpose (string utilities) and its actual contents (a remote-code loader) is a cover-story pattern.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-020171",
            "import_time": "2026-09-18T00:47:16.843800762Z",
            "modified_time": "2026-09-17T23:19:27Z",
            "sha256": "aa3c9f5edcc636fc8d38e40a6bb225aed8f6b638be31f2abf8b6e747212c9565",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / blue-string-formatter-utils

Package

Name
blue-string-formatter-utils
View open source insights on deps.dev
Purl
pkg:npm/blue-string-formatter-utils

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "payload.js",
            "sha256": "82125c5a92dfa30275e7e3dc861d3c4e3ae65915c2ba315f6c9b4593e51471d7",
            "tlsh": "75c08055864894e04211b798d655950035734b052943c46d111c51c01e29da09500491"
        },
        {
            "path": "package.json",
            "sha256": "7c46e99c3dab22a2b9af79fb5402a6804e26110cfe4f042411a8713391f28b9e",
            "tlsh": "13d02b20ca52443309c1411b5994d142a338ef0f14447c1e97df250c434eab6a9f678c"
        }
    ],
    "package_integrity": [
        {
            "filename": "blue-string-formatter-utils-1.0.0.tgz",
            "hashes": {
                "sha1": "19521c703a101d91775b571f7ba7c510419759d6",
                "sha512_sri": "sha512-SDh0l4LzqUIqy7iyCgzgSpme+Ql0C+H2YEWLSgyOTkOglPNzKgNNj+E6NYnBOnTYRcmP88ZtXoRsrp5Cc/1ygw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/blue-string-formatter-utils/MAL-2026-16273.json"