Malicious code in element-guci-util (npm)

The 'element-guci-util' npm package masquerades as a utility library but contains top-level code that activates on or after 2026-10-01. This code triggers a forced download of a fabricated executable file, opens a malicious URL (https://admin.nikolive.cn/), repeatedly reloads the page, and initiates CPU and memory exhaustion loops. The package's metadata includes placeholder values and a self-referential dependency version that causes altered resolution of subsequent installs. This behavior results in an attacker-benefiting payload delivered to downstream users of any web application bundling this module. The malicious actions compromise the integrity and availability of affected systems.

Any system with this package installed or running after the trigger date should be considered fully compromised. The forced download of an executable and redirection to an attacker-controlled site pose direct security risks to end users. The CPU and memory exhaustion loops degrade system performance and availability. Because the package may have granted full control to an attacker, all secrets and keys stored on the compromised system should be considered exposed and rotated immediately. Removal of the package alone does not guarantee elimination of all malicious artifacts or control.

No official patch or fix is indicated. Immediate removal of the 'element-guci-util' package from all systems is recommended. Due to the severity of compromise, all credentials and secrets stored on affected systems should be rotated from a secure, uncompromised environment. Monitor for any signs of persistent malicious activity. Because the package triggers malicious behavior only after a future date, proactively auditing dependencies and avoiding use of this package is critical. Consider blocking or removing this package from internal repositories and dependency manifests.