MalwarePublished 14 Jul 2026Updated 27 Jul 2026

fluterjs (npm) · Malicious Code

Affects fluterjsSource GCVE Database

Malicious package : remove fluterjs and rotate any secrets on hosts that installed it.

Data as of 26 Oct 2026, 15:56 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10532

What to do

Remove fluterjs from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmfluterjs	Affected =1.0.0	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package fluterjs version 1.0.0 contains malicious code that starts an Express server exposing a POST endpoint /ejecutar. This endpoint accepts a JSON field 'comando' and executes it directly on the host system without any authentication, origin checks, or command restrictions. This behavior effectively creates a remote shell backdoor, allowing any network-accessible attacker to execute arbitrary commands as the user running the package. The package masquerades as a terminal helper but is intentionally designed to provide unauthorized remote code execution.

Impact

An attacker with network access to the host running fluterjs 1.0.0 can execute arbitrary shell commands remotely with the same privileges as the user running the package. This can lead to full system compromise, data theft, or further lateral movement. There are no built-in protections such as authentication or command filtering, making exploitation trivial if the host is exposed to untrusted networks.

Defensive guidance

Users should immediately uninstall this package and avoid running it in any environment. Network exposure of hosts running this package should be restricted or blocked. Monitor for any usage of this package and remove it from all systems. Since this is a malicious package by design, do not attempt to use or trust it.

Summary

fluterjs version 1.0.0 includes a backdoor implemented as an Express server listening on 0.0.0.0:10459 with a POST /ejecutar endpoint. The endpoint reads the 'comando' field from incoming JSON requests and passes it directly to child_process.exec without any authentication or validation. This design allows any network-reachable entity to execute arbitrary shell commands on the host with the privileges of the user who started the process. This is a deliberate malicious feature disguised as a legitimate terminal helper package.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Jul 2026, 09:32 UTC

Technical details

References

Community reviews