MAL-2026-17418

    Dashboard / Malicious Package / MAL-2026-17418

    MAL-2026-17418

    Published: 30 Sept 2026Last Modified: 1 Oct 2026

    Summary: Malicious code in future-scripts (npm)

    Details: On October 10, 2026 (local time), boom() calls localStorage.setItem('key', i) 100,000,000 times in a synchronous loop, potentially freezing a browser page. In version 0.0.2, the exported getCommonDateInRanges() calls boom() before input validation; the bundled source map confirms this path. Version 0.0.3 retains boom() as a separate export but no longer calls it from getCommonDateInRanges(), so an explicit call is required. Version 0.0.1 does not contain this routine. This is a static finding; actual victim impact was not observed.

    References:

    Affected packages

    Package

    Name: future-scripts

    Purl: pkg:npm/future-scripts

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.0.2
    0.0.3