Malicious code in fe-utils-core (npm)
The npm package fe-utils-core versions 1.0.4 and 1.0.5 contain malicious code that fetches and executes attacker-controlled JavaScript from a hardcoded external domain. This code executes with full Node.js privileges, enabling arbitrary code execution. The package includes unused dependencies that facilitate credential harvesting and persistent command-and-control (C2) communication. Any system with this package installed should be considered fully compromised, and all secrets should be rotated immediately.
AI Analysis
Technical Summary
The fe-utils-core npm package (versions 1.0.4 and 1.0.5) exports a getPlugin function that fetches JavaScript code from a hardcoded external URL unrelated to the package's stated purpose. The fetched code's data.credits field is passed to a new Function() call with Node.js globals injected, allowing arbitrary attacker-controlled code execution with full privileges. The package silently retries failed requests, consistent with covert C2 behavior. It also pre-installs dependencies such as @primno/dpapi, node-machine-id, better-sqlite3, sqlite3, socket.io-client, axios, express, and request, which are unused by the advertised utility but enable credential harvesting and persistent C2. This combination indicates intentional malicious functionality rather than benign use.
Potential Impact
Systems with fe-utils-core versions 1.0.4 or 1.0.5 installed are fully compromised, as the package executes arbitrary attacker-controlled code with full Node.js privileges. This can lead to credential theft, persistent remote access, and complete system takeover. Secrets and keys stored on affected systems are at risk and should be considered compromised.
Mitigation Recommendations
Remove the fe-utils-core package versions 1.0.4 and 1.0.5 immediately from all affected systems. Rotate all secrets and keys from a secure, uncompromised environment. Due to the full system compromise risk, further forensic analysis and remediation may be necessary to ensure no residual malicious software remains. No official patch or fix is currently available; patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.
Malicious code in fe-utils-core (npm)
Description
The npm package fe-utils-core versions 1.0.4 and 1.0.5 contain malicious code that fetches and executes attacker-controlled JavaScript from a hardcoded external domain. This code executes with full Node.js privileges, enabling arbitrary code execution. The package includes unused dependencies that facilitate credential harvesting and persistent command-and-control (C2) communication. Any system with this package installed should be considered fully compromised, and all secrets should be rotated immediately.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The fe-utils-core npm package (versions 1.0.4 and 1.0.5) exports a getPlugin function that fetches JavaScript code from a hardcoded external URL unrelated to the package's stated purpose. The fetched code's data.credits field is passed to a new Function() call with Node.js globals injected, allowing arbitrary attacker-controlled code execution with full privileges. The package silently retries failed requests, consistent with covert C2 behavior. It also pre-installs dependencies such as @primno/dpapi, node-machine-id, better-sqlite3, sqlite3, socket.io-client, axios, express, and request, which are unused by the advertised utility but enable credential harvesting and persistent C2. This combination indicates intentional malicious functionality rather than benign use.
Potential Impact
Systems with fe-utils-core versions 1.0.4 or 1.0.5 installed are fully compromised, as the package executes arbitrary attacker-controlled code with full Node.js privileges. This can lead to credential theft, persistent remote access, and complete system takeover. Secrets and keys stored on affected systems are at risk and should be considered compromised.
Mitigation Recommendations
Remove the fe-utils-core package versions 1.0.4 and 1.0.5 immediately from all affected systems. Rotate all secrets and keys from a secure, uncompromised environment. Due to the full system compromise risk, further forensic analysis and remediation may be necessary to ensure no residual malicious software remains. No official patch or fix is currently available; patch status is not yet confirmed — check the vendor advisory or trusted sources for updates.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-4561
- Osv Schema Version
- 1.7.4
- Aliases
- ["GHSA-8xf7-7m4f-fgrv"]
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a870a77acd9273b49b593b4
Added to database: 08/20/2026, 14:08:55 UTC
Last enriched: 08/20/2026, 14:36:43 UTC
Last updated: 08/20/2026, 15:05:33 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.