blue-string-formatter-utilss

{"modified":"2026-09-21T19:48:44Z","published":"2026-09-21T19:48:44Z","schema_version":"1.7.4","id":"MAL-2026-16363","summary":"Malicious code in blue-string-formatter-utilss (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (de9e55c734c18f91b4b3a043dd6539097aa4e57056ff9dca6df1a9d3a3631c25)\nThe package advertises itself as string-formatting utilities but ships no formatter code. Its main entry `payload.js` is an IIFE that creates a `<script>` element with `src='https://xss.report/c/k3rne111'` and appends it to `document.body`, causing an attacker-controlled remote script to be fetched and executed whenever the module is loaded in a DOM context. xss.report is a known XSS payload-delivery service. The name-versus-behavior mismatch (a 'string formatter' whose only behavior is a remote script loader) is a typosquat cover story rather than legitimate functionality.\n","affected":[{"package":{"ecosystem":"npm","name":"blue-string-formatter-utilss"},"versions":["1.2.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"payload.js","sha256":"27d2c92ea7e1674ad1185b4c4c157beb7a6d2a973bf493f2d832dc9775e79b3b","tlsh":"85c08c2e1da8d02000322adb2137ea58367118282812e10564e8d91ca820fd60c06cd4"},{"path":"package.json","sha256":"713bb0976664c7154ec320b6401f48f19819188eaecc11b749cc83f39caeab5f","tlsh":"cbd02b20ca52443319c1411f5c94d142a338ef0f14403c1e9bdf250c434daf6a9f678d"}],"package_integrity":[{"filename":"blue-string-formatter-utilss-1.2.0.tgz","hashes":{"sha1":"4951b006f430783f4212c71b82ed526634c7fcec","sha512_sri":"sha512-9e1vDf8tc84riO32Kn4FL3tSzj4tcfa0wKZNfbxZnu4Ag9+RHDsBfBYF14mFjrvjT4belIJADXnIrxb8filtnQ=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/blue-string-formatter-utilss/v/1.2.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020274","import_time":"2026-09-21T20:17:15.574332821Z","modified_time":"2026-09-21T19:48:44Z","sha256":"de9e55c734c18f91b4b3a043dd6539097aa4e57056ff9dca6df1a9d3a3631c25","source":"amazon-inspector","versions":["1.2.0"]}]}}