MalwarePublished 21 Sep 2026

blue-string-formatter-utilss (npm) · Malicious Code

Affects blue-string-formatter-utilssSource GCVE Database

Malicious package : remove blue-string-formatter-utilss and rotate any secrets on hosts that installed it.

Data as of 24 Sep 2026, 04:32 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-16363

What to do

Remove blue-string-formatter-utilss from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmblue-string-formatter-utilss	Affected =1.2.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package 'blue-string-formatter-utilss' version 1.2.0 is malicious. Instead of providing string formatting utilities as advertised, it executes a remote script from a known XSS payload delivery service when loaded in a DOM context. This behavior indicates the package is a typosquatting attempt designed to deliver attacker-controlled code.

Impact

Users who install and load this package in environments that execute DOM scripts will inadvertently execute attacker-controlled remote code. This can lead to compromise of the client environment, data theft, or further exploitation depending on the payload delivered by the remote script. There are no known exploits in the wild reported at this time.

Defensive guidance

The package should be considered malicious and avoided. Users should verify package names carefully to avoid typosquatting attacks and remove any installations of 'blue-string-formatter-utilss' version 1.2.0. Use trusted sources and verify package authenticity before installation.

Summary

The 'blue-string-formatter-utilss' npm package (version 1.2.0) masquerades as a string formatting utility but contains no legitimate formatter code. Its main entry point, 'payload.js', is an immediately invoked function expression (IIFE) that dynamically creates a <script> element with its source set to 'https://xss.report/c/k3rne111'. This script is appended to the document body, causing the execution of remote attacker-controlled JavaScript whenever the module is loaded in a DOM environment. The domain 'xss.report' is known for hosting XSS payloads, confirming the malicious intent. This package is a typosquat designed to trick users into installing it under the guise of a legitimate utility.

References

npmjs.com/package/blue-string-formatter-utilss/v/1.2.0 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 24 Sep 2026, 04:32 UTC

Technical details

References

Community reviews