jsf-utils (npm) · Malicious Code
Affects jsf-utilsSource GCVE Database
Malicious package : remove jsf-utils and rotate any secrets on hosts that installed it.
Data as of 10 Jul 2026, 10:05 UTC
Malicious package
Published to npm · OSV MAL-2026-6921
What to do
Remove jsf-utils from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| npmjsf-utils | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
The npm package jsf-utils versions 1.3.1 and 0.3.1 contains malicious code that executes a remote JavaScript payload at import time. This payload is fetched from a mutable anonymous paste service and executed with full access to the installer's environment, enabling arbitrary code execution. The package impersonates a legitimate utility by reusing metadata from a trusted author and conceals the malicious logic inside a seemingly benign string helper module. The malicious code also spawns a detached Node.js process to maintain persistence beyond the initial import. Systems with this package installed should be considered fully compromised.