MAL-2026-17418: Malicious code in future-scripts (npm)
On October 10, 2026 (local time), boom() calls localStorage.setItem('key', i) 100,000,000 times in a synchronous loop, potentially freezing a browser page. In version 0.0.2, the exported getCommonDateInRanges() calls boom() before input validation; the bundled source map confirms this path. Version 0.0.3 retains boom() as a separate export but no longer calls it from getCommonDateInRanges(), so an explicit call is required. Version 0.0.1 does not contain this routine. This is a static finding; actual victim impact was not observed.
--- -= Per source details. Do not edit below this line.=-
Source: ghsa-malware (85a5edaae5c58b417dfd2c63bf8f2529bc3aa75784254950f457847fc7840561) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
npm/future-scriptsfrom your environment.Remove the future-scripts package.
- Operational
Immediately rotate all secrets and keys stored on any computer that has the package installed or running, using a different computer.
Event History
Frequently Asked Questions
Which versions require action?
Version 0.0.2 invokes boom() from getCommonDateInRanges() before validating input. Version 0.0.3 retains boom() but requires an explicit call to it, while version 0.0.1 does not contain the routine.
What conditions trigger the browser impact?
In version 0.0.2, calling the exported getCommonDateInRanges() reaches boom() automatically. boom() synchronously performs 100,000,000 localStorage.setItem() calls, which can freeze a browser page.
Was exploitation or victim impact observed?
No actual victim impact was observed. The finding is based on static analysis, with the bundled source map confirming the affected call path in version 0.0.2.
What should be done if this package is installed or has run?
The source advises treating any computer with the package installed or running as fully compromised, rotating secrets and keys from a different computer, and removing the package. It also cautions that removal may not eliminate all malicious software if control of the computer was obtained.