blue-string-formatter-utilss

Details

**Severity:** Critical

**Affected versions:** `= 1.2.0`

## Source: amazon-inspector (de9e55c734c18f91b4b3a043dd6539097aa4e57056ff9dca6df1a9d3a3631c25)
The package advertises itself as string-formatting utilities but ships no formatter code. Its main entry `payload.js` is an IIFE that creates a `<script>` element with `src='https://xss.report/c/k3rne111'` and appends it to `document.body`, causing an attacker-controlled remote script to be fetched and executed whenever the module is loaded in a DOM context. xss.report is a known XSS payload-delivery service. The name-versus-behavior mismatch (a 'string formatter' whose only behavior is a remote script loader) is a typosquat cover story rather than legitimate functionality.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/8b22724c6b21215e1887acbd30e4ea6c5cef5d35/osv/malicious/npm/blue-string-formatter-utilss/MAL-2026-16363.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/8b22724c6b21215e1887acbd30e4ea6c5cef5d35/osv/malicious/npm/blue-string-formatter-utilss/MAL-2026-16363.json
- https://www.npmjs.com/package/blue-string-formatter-utilss/v/1.2.0
- https://github.com/advisories/GHSA-4g26-86h7-34h3

Compromised versions (1)

• = 1.2.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.