STRUTIL-HELPERS-CORE · MAL-2026-19144 · Package
UNINSTALL IT, ROTATE THE KEYS IT COULD READ
Not triaged yet. The sources’ own description is below.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Unknown from the sources.
Unknown from the sources.
-= Per source details. Do not edit below this line.=-
The package advertises itself as lightweight string utility helpers (trim/capitalize/truncate), but ships a 17KB Linux ELF.node addon, a 434KB Windows PE.node addon, and a 3.7MB opaque.napi_cache data blob none of which are needed for the stated purpose. index.js unconditionally loads the platform-appropriate native addon on every require() and swallows errors silently before the trivial string helpers are even defined. The native addon references the adjacent.napi_cache blob and contains code paths for file I/O, fork/setsid/execlp on Linux and CreateProcessA with a 'node "%s"' command template on Windows, staging decoded JavaScript at /tmp/.<pid> (format string /tmp/.%u, %s.nc%lu.js) and executing it under node. Before firing, the addon enumerates CI and sandbox indicators (GITHUB_ACTIONS, GITLAB_CI, TRAVIS, CIRCLECI, JENKINS_URL, BUILDKITE, CODEBUILD_BUILD_ID, APPVEYOR, SEMAPHORE, TEAMCITY_VERSION, BITBUCKET_BUILD_NUMBER, NETLIFY, VERCEL, CF_BUILD_ID, SCREWDRIVER, SANDBOX), reads /proc/1/cgroup, /proc/1/cmdline, /proc/self/status (TracerPid) and /proc/self/maps for docker/containerd/kubepod/podman markers, and on Windows checks IsDebuggerPresent, CheckRemoteDebuggerPresent and scans running processes for analysis tools (wireshark, httpdebug, Process32First). The combination of a trivial cover-story API, undeclared native binaries loaded silently on import, an opaque sibling blob decrypted to a hidden /tmp staging path and executed under node, and sandbox/CI/debugger evasion gating is a load-time dropper that runs attacker-controlled code on the installer's host as soon as the package is required.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.