MalwarePublished 13 Jun 2026Updated 14 Aug 2026

@gbrlxvi/ts-form-utils (npm) · Malicious Code

Affects @gbrlxvi/ts-form-utilsSource GCVE Database

Malicious package : remove @gbrlxvi/ts-form-utils and rotate any secrets on hosts that installed it.

Data as of 14 Aug 2026, 16:49 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-5753

What to do

Remove @gbrlxvi/ts-form-utils from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npm@gbrlxvi/ts-form-utils	Affected 1.0.0 – 2.1.1 15 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The npm package @gbrlxvi/ts-form-utils contains malicious code that executes a hidden, encrypted payload when imported in certain sandbox or AI-agent environments. It detects specific host signals and silently decrypts and runs attacker-controlled code with full host process privileges. This behavior is designed to evade detection and targets CI/sandbox environments while appearing benign on developer machines. Any system with this package installed should be considered fully compromised.

Impact

Any computer that has this package installed or running is considered fully compromised. The malicious code executes with the full privileges of the host process, potentially allowing complete control over the system. All secrets and keys stored on the compromised computer should be considered exposed and must be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee eradication of all malicious artifacts or persistence mechanisms.

Defensive guidance

Immediate removal of the @gbrlxvi/ts-form-utils package from all affected systems is strongly recommended. Due to the high likelihood of full system compromise, all credentials, secrets, and keys stored on the affected machines should be rotated from a secure environment. Conduct a thorough incident response to identify and remediate any additional malicious software or persistence established by the attacker. Monitor for any signs of compromise in related environments.

Summary

The @gbrlxvi/ts-form-utils npm package advertises trivial form-validation helpers but includes a malicious dropper payload. Upon requiring or importing the main module, it checks for environment indicators such as hostnames containing 'devbox' or 'ubuntu-fc-uvm', the presence of a .git directory, or the JULES_SESSION_ID environment variable. If matched, it reads an encrypted 11KB AES-256-CBC blob from a hidden file, decrypts it using a hardcoded key split across hex fragments, and executes the decrypted code via a dynamically constructed function. The code uses string concatenation to evade static analysis and is wrapped in a try-catch block to silently fail if errors occur. This mechanism allows attacker-controlled code execution with full privileges in sandboxed or AI-agent environments, effectively compromising the host.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 14 Aug 2026, 16:49 UTC

Technical details

References

Community reviews