MAL-2026-16273

    Dashboard / Malicious Package / MAL-2026-16273

    MAL-2026-16273

    Published: 17 Sept 2026Last Modified: 18 Sept 2026

    Summary: Malicious code in blue-string-formatter-utils (npm)

    Details: Source: amazon-inspector (aa3c9f5edcc636fc8d38e40a6bb225aed8f6b638be31f2abf8b6e747212c9565) The package advertises itself as 'Utility helpers for string formatting' but its shipped main file performs a single behavior: an XMLHttpRequest GET to the protocol-relative URL //xss.report/c/k3rne111 whose response body is passed directly to eval(). Any require()/import of this package causes arbitrary attacker-controlled JavaScript from xss.report to execute in the consumer's Node process, with no pinning, no integrity check, and no relationship to the advertised functionality. The mismatch between the package's stated purpose (string utilities) and its actual contents (a remote-code loader) is a cover-story pattern.

    References: https://www.npmjs.com/package/blue-string-formatter-utils/v/1.0.0

    Affected packages

    Package

    Name: blue-string-formatter-utils

    Purl: pkg:npm/blue-string-formatter-utils

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0