The npm package jsf-utils versions 1.3.1 and 0.3.1 contains malicious code that executes a remote JavaScript payload at import time. This payload is fetched from a mutable anonymous paste service and executed with full access to the installer's environment, enabling arbitrary code execution. The package impersonates a legitimate utility by reusing metadata from a trusted author and conceals the malicious logic inside a seemingly benign string helper module. The malicious code also spawns a detached Node.js process to maintain persistence beyond the initial import. Systems with this package installed should be considered fully compromised.