FCEFI-WDOJS-UTIL · MAL-2026-19142 · Package
UNINSTALL IT, ROTATE THE KEYS IT COULD READ
Not triaged yet. The sources’ own description is below.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Unknown from the sources.
Unknown from the sources.
-= Per source details. Do not edit below this line.=-
fcefi-wdojs-util@1.0.0 ships a loader in index.js that reads an undeclared _bz numeric array (~1000 bytes) from its own package.json, zlib-inflates it, and executes the resulting JavaScript via the Function constructor on every require of the package. The loader is wrapped in an IIFE that explicitly short-circuits when any of CI, GITHUB_ACTIONS, GITLAB_CI, TRAVIS, CIRCLECI, or SANDBOX are set in the environment, so the payload only runs on developer and production hosts and stays inert in scanning environments. Adjacent to the loader, lib/native.pkg_config is a 2,890,302-byte file containing only hex characters with no printable strings and no relation to native code or pkg-config, consistent with an encrypted stage-2 payload decrypted by the inflated bytecode. The combination — executable code smuggled inside the manifest as a non-standard field, require-time Function()-based execution, deliberate CI/sandbox evasion, and a large opaque hex blob shipped as a misleadingly named config file — is a multi-stage dropper with no legitimate utility function.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.