MalwarePublished 13 Jul 2026

note-utilities (npm) · Malicious Code

Affects note-utilitiesSource GCVE Database

Malicious package : remove note-utilities and rotate any secrets on hosts that installed it.

Data as of 13 Jul 2026, 09:27 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-10418

What to do

Remove note-utilities from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmnote-utilities	Affected =2.1.2	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The note-utilities npm package version 2.1.2 contains malicious code masquerading as a pino-style logger. It includes a hidden loader script (lib/vcall.js) that runs a detached child Node.js process. This process fetches JavaScript code from a remote attacker-controlled HTTPS endpoint and executes it with full module-loading privileges in the installer's environment. This allows arbitrary code execution during installation, posing a significant security risk.

Impact

This vulnerability allows an attacker to execute arbitrary JavaScript code on any system that installs note-utilities version 2.1.2. The malicious code runs with the same privileges as the user installing the package, potentially leading to full system compromise, data theft, or further malware deployment. Because the malicious code is fetched dynamically from a remote endpoint, the attacker can change the payload at any time after installation.

Defensive guidance

Users should avoid installing or using this package version. Verify package authenticity before installation and consider using trusted package sources or alternatives. Monitor vendor advisories for any updates or fixes. Since this is a malicious package, removal from the environment and investigation of any installed instances is recommended.

Summary

The note-utilities package (version 2.1.2) pretends to be a pino-style logger but includes a malicious loader script (lib/vcall.js). Upon requiring the package, index.js spawns a detached Node.js child process running lib/vcall.js, which performs an HTTPS GET request to a remote JSON endpoint controlled by an attacker. The returned JavaScript code is dynamically constructed and executed using Function constructor with access to the real require function, enabling arbitrary code execution with the privileges of the installing process. The remote endpoint is mutable by the attacker, making this a supply chain attack vector.

References

npmjs.com/package/note-utilities/v/2.1.2 (opens in a new tab)

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 13 Jul 2026, 09:27 UTC

Technical details

References

Community reviews