MAL-2026-16363
Malicious code in blue-string-formatter-utilss (npm)
Details
--- _-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (de9e55c734c18f91b4b3a043dd6539097aa4e57056ff9dca6df1a9d3a3631c25) The package advertises itself as string-formatting utilities but ships no formatter code. Its main entry `payload.js` is an IIFE that creates a `<script>` element with `src='https://xss.report/c/k3rne111'` and appends it to `document.body`, causing an attacker-controlled remote script to be fetched and executed whenever the module is loaded in a DOM context. xss.report is a known XSS payload-delivery service. The name-versus-behavior mismatch (a 'string formatter' whose only behavior is a remote script loader) is a typosquat cover story rather than legitimate functionality.
Are you affected?
Enter the version of the package you're using.
Affected packages
No fixed version published yet for blue-string-formatter-utilss (npm). Pin to a known-safe version or switch to an alternative.