MAL-2026-17418

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/future-scripts/MAL-2026-17418.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-17418

Published

2026-09-30T00:13:16Z

Modified

2026-10-01T05:45:04Z

Summary

Malicious code in future-scripts (npm)

Details

On October 10, 2026 (local time), boom() calls localStorage.setItem('key', i) 100,000,000 times in a synchronous loop, potentially freezing a browser page. In version 0.0.2, the exported getCommonDateInRanges() calls boom() before input validation; the bundled source map confirms this path. Version 0.0.3 retains boom() as a separate export but no longer calls it from getCommonDateInRanges(), so an explicit call is required. Version 0.0.1 does not contain this routine. This is a static finding; actual victim impact was not observed.

Credits

- ESTsecurity - FINDER

Affected packages

npm / future-scripts

Package

Name: future-scripts; View open source insights on deps.dev
Purl: pkg:npm/future-scripts

Affected ranges

Affected versions

0.*

0.0.2

0.0.3

Database specific

cwes

[
    {
        "cweId":  "CWE-400",
        "description":  "The product does not properly control the allocation and maintenance of a limited resource.",
        "name":  "Uncontrolled Resource Consumption"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/future-scripts/MAL-2026-17418.json"