---
id: "MAL-2026-19142"
page: "https://infrastack.ai/live/MAL-2026-19142"
kind: "package"
aliases: ["MAL-2026-19142"]
title: "Malicious code in fcefi-wdojs-util (npm)"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "fcefi-wdojs-util", "fixed": [], "affected": "= 1.0.0", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["malicious", "package"]
not_affected_if: []
published_at: "2026-11-11T21:01:46+00:00"
first_seen_at: "2026-11-11T21:29:24+00:00"
updated_at: "2026-11-11T21:31:13+00:00"
sources: [{"source": "osv-malicious", "url": "https://osv.dev/vulnerability/MAL-2026-19142", "first_seen_at": "2026-11-11T21:29:24+00:00"}]
exploit_sources: []
---

# Malicious code in fcefi-wdojs-util (npm)

Link for people: https://infrastack.ai/live/MAL-2026-19142 (this .md is for agents)

## Affected

- npm:fcefi-wdojs-util affected = 1.0.0 fixed no fixed version listed

## Timeline

- 2026-11-11T21:29:24+00:00 osv-malicious https://osv.dev/vulnerability/MAL-2026-19142

## From the sources

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (07a00a17209ccc173a7196dd8e97486609819945db1459a5333463be9f6c20b9)
fcefi-wdojs-util@1.0.0 ships a loader in index.js that reads an undeclared `_bz` numeric array (~1000 bytes) from its own package.json, zlib-inflates it, and executes the resulting JavaScript via the Function constructor on every require of the package. The loader is wrapped in an IIFE that explicitly short-circuits when any of `CI`, `GITHUB_ACTIONS`, `GITLAB_CI`, `TRAVIS`, `CIRCLECI`, or `SANDBOX` are set in the environment, so the payload only runs on developer and production hosts and stays inert in scanning environments. Adjacent to the loader, lib/native.pkg_config is a 2,890,302-byte file containing only hex characters with no printable strings and no relation to native code or pkg-config, consistent with an encrypted stage-2 payload decrypted by the inflated bytecode. The combination — executable code smuggled inside the manifest as a non-standard field, require-time Function()-based execution, deliberate CI/sandbox evasion, and a large opaque hex blob shipped as a misleadingly named config file — is a multi-stage dropper with no legitimate utility function.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_