Malicious code in ts-utility-plus (npm)
The npm package ts-utility-plus version 1.3.2 contains malicious code that performs an HTTPS request to a hardcoded IP address. The response includes code that is dynamically executed within the Node.js process, enabling arbitrary code execution. The malicious payload masquerades as Font Awesome icon CDN traffic and may deliver a credential or browser secret stealer. This behavior occurs whenever the package's default export function is called.
AI Analysis
Technical Summary
The ts-utility-plus package (version 1.3.2) exports a function getPlugin that makes an HTTPS request to a hardcoded bare-IP endpoint (https://31.97.137.157:45000/icons/109). It extracts the 'data.credits' field from the response and executes it as code using the JavaScript Function constructor, injecting Node.js globals such as require, process, and Buffer. This allows the remote operator of the IP address to execute arbitrary code within the Node.js process running the package. The malicious code is disguised with references to Font Awesome icon CDN naming conventions. The package also declares dependencies consistent with a follow-on credential or browser secret stealer, indicating further malicious intent.
Potential Impact
This vulnerability allows an attacker controlling the remote server at the hardcoded IP address to execute arbitrary code inside the Node.js process that requires and calls the package's default export. This can lead to full compromise of the host environment, including theft of credentials or secrets via additional malicious payloads. The compromise occurs simply by requiring and invoking the package, making it a severe supply chain risk.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately stop using ts-utility-plus version 1.3.2 and remove it from their projects. Avoid calling the default export function of this package. Monitor for updates from the package maintainer or trusted security advisories for any official fixes or further guidance. Consider auditing dependencies for similar malicious behavior.
Malicious code in ts-utility-plus (npm)
Description
The npm package ts-utility-plus version 1.3.2 contains malicious code that performs an HTTPS request to a hardcoded IP address. The response includes code that is dynamically executed within the Node.js process, enabling arbitrary code execution. The malicious payload masquerades as Font Awesome icon CDN traffic and may deliver a credential or browser secret stealer. This behavior occurs whenever the package's default export function is called.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The ts-utility-plus package (version 1.3.2) exports a function getPlugin that makes an HTTPS request to a hardcoded bare-IP endpoint (https://31.97.137.157:45000/icons/109). It extracts the 'data.credits' field from the response and executes it as code using the JavaScript Function constructor, injecting Node.js globals such as require, process, and Buffer. This allows the remote operator of the IP address to execute arbitrary code within the Node.js process running the package. The malicious code is disguised with references to Font Awesome icon CDN naming conventions. The package also declares dependencies consistent with a follow-on credential or browser secret stealer, indicating further malicious intent.
Potential Impact
This vulnerability allows an attacker controlling the remote server at the hardcoded IP address to execute arbitrary code inside the Node.js process that requires and calls the package's default export. This can lead to full compromise of the host environment, including theft of credentials or secrets via additional malicious payloads. The compromise occurs simply by requiring and invoking the package, making it a severe supply chain risk.
Mitigation Recommendations
No official patch or remediation is currently documented. Users should immediately stop using ts-utility-plus version 1.3.2 and remove it from their projects. Avoid calling the default export function of this package. Monitor for updates from the package maintainer or trusted security advisories for any official fixes or further guidance. Consider auditing dependencies for similar malicious behavior.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-13617
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["npm"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a77432dbf8831d539b461f2
Added to database: 08/08/2026, 14:54:37 UTC
Last enriched: 08/08/2026, 15:40:27 UTC
Last updated: 08/08/2026, 23:55:40 UTC
Views: 8
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.