Malicious code in ai-texts-utils (npm)
The npm package ai-texts-utils versions 1.0.0 through 1.0.3 contains a malicious payload embedded within a bundled dependency named ai-texts. This payload includes heavily obfuscated code that executes upon module import, employing anti-debugging techniques and dynamic code execution. The malicious code likely performs host fingerprinting and potentially compromises the host system. Installation or execution of this package can lead to full system compromise, requiring immediate secret and key rotation and removal of the package.
AI Analysis
Technical Summary
The ai-texts-utils npm package (versions 1.0.0 to 1.0.3) includes a bundled dependency 'ai-texts' that contains a malicious payload appended to otherwise benign helper functions. The payload is heavily obfuscated with rotated string arrays, custom base64 decoding, anti-debugging wrappers, and dynamic Function() calls that execute immediately upon module load. The obfuscated code references the 'os' module but does not expose it in exports, indicating hidden host fingerprinting behavior. According to the source, any system with this package installed or running should be considered fully compromised, as the malicious code may grant an attacker full control over the host.
Potential Impact
Systems with ai-texts-utils versions 1.0.0 through 1.0.3 installed or running are at risk of full compromise. The malicious payload can execute arbitrary code on the host, potentially allowing attackers to access all secrets and keys stored on the system. This level of compromise means attackers may have persistent control beyond just the package itself, making removal insufficient to guarantee system integrity.
Mitigation Recommendations
Immediate removal of the ai-texts-utils package versions 1.0.0 through 1.0.3 is required. All secrets and keys stored on the affected system should be rotated from a separate, trusted environment. Due to the potential for full system compromise, a thorough incident response and system integrity verification are recommended. No official patch or fix is indicated; therefore, avoidance of these package versions is advised.
Malicious code in ai-texts-utils (npm)
Description
The npm package ai-texts-utils versions 1.0.0 through 1.0.3 contains a malicious payload embedded within a bundled dependency named ai-texts. This payload includes heavily obfuscated code that executes upon module import, employing anti-debugging techniques and dynamic code execution. The malicious code likely performs host fingerprinting and potentially compromises the host system. Installation or execution of this package can lead to full system compromise, requiring immediate secret and key rotation and removal of the package.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The ai-texts-utils npm package (versions 1.0.0 to 1.0.3) includes a bundled dependency 'ai-texts' that contains a malicious payload appended to otherwise benign helper functions. The payload is heavily obfuscated with rotated string arrays, custom base64 decoding, anti-debugging wrappers, and dynamic Function() calls that execute immediately upon module load. The obfuscated code references the 'os' module but does not expose it in exports, indicating hidden host fingerprinting behavior. According to the source, any system with this package installed or running should be considered fully compromised, as the malicious code may grant an attacker full control over the host.
Potential Impact
Systems with ai-texts-utils versions 1.0.0 through 1.0.3 installed or running are at risk of full compromise. The malicious payload can execute arbitrary code on the host, potentially allowing attackers to access all secrets and keys stored on the system. This level of compromise means attackers may have persistent control beyond just the package itself, making removal insufficient to guarantee system integrity.
Mitigation Recommendations
Immediate removal of the ai-texts-utils package versions 1.0.0 through 1.0.3 is required. All secrets and keys stored on the affected system should be rotated from a separate, trusted environment. Due to the potential for full system compromise, a thorough incident response and system integrity verification are recommended. No official patch or fix is indicated; therefore, avoidance of these package versions is advised.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-14302
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-3p3q-38q9-rr37"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a870a74acd9273b49b58ab8
Added to database: 08/20/2026, 14:08:52 UTC
Last enriched: 08/20/2026, 14:30:41 UTC
Last updated: 08/20/2026, 14:30:41 UTC
Views: 2
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.