npm · Malicious package advisory
Malwarefuture-scripts
GHSA-c9xw-xmvx-ffm7
Malicious code in future-scripts (npm)
Details
**Severity:** Critical
**Affected versions:** `= 0.0.2`
On October 10, 2026 (local time), boom() calls localStorage.setItem('key', i) 100,000,000 times in a synchronous loop, potentially freezing a browser page. In version 0.0.2, the exported getCommonDateInRanges() calls boom() before input validation; the bundled source map confirms this path. Version 0.0.3 retains boom() as a separate export but no longer calls it from getCommonDateInRanges(), so an explicit call is required. Version 0.0.1 does not contain this routine. This is a static finding; actual victim impact was not observed.
---
Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/03666f5e7d007a161251954396c72a1a546a29e7/osv/malicious/npm/future-scripts/MAL-2026-17418.json))
**References:**
- https://github.com/ossf/malicious-packages/blob/03666f5e7d007a161251954396c72a1a546a29e7/osv/malicious/npm/future-scripts/MAL-2026-17418.json
- https://github.com/advisories/GHSA-c9xw-xmvx-ffm7Compromised versions (1)
- = 0.0.2
Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.