MAL-2026-19144: Malicious code in strutil-helpers-core (npm)

Published Nov 11, 2026

Updated

--- -= Per source details. Do not edit below this line.=-

Source: amazon-inspector (db7da8999828536292e11d09747504d964bf7525862de7d207d03c8809c438a0) The package advertises itself as lightweight string utility helpers (trim/capitalize/truncate), but ships a 17KB Linux ELF.node addon, a 434KB Windows PE.node addon, and a 3.7MB opaque.napicache data blob none of which are needed for the stated purpose. index.js unconditionally loads the platform-appropriate native addon on every require() and swallows errors silently before the trivial string helpers are even defined. The native addon references the adjacent.napicache blob and contains code paths for file I/O, fork/setsid/execlp on Linux and CreateProcessA with a 'node "%s"' command template on Windows, staging decoded JavaScript at /tmp/.<pid> (format string /tmp/.%u, %s.nc%lu.js) and executing it under node. Before firing, the addon enumerates CI and sandbox indicators (GITHUBACTIONS, GITLABCI, TRAVIS, CIRCLECI, JENKINSURL, BUILDKITE, CODEBUILDBUILDID, APPVEYOR, SEMAPHORE, TEAMCITYVERSION, BITBUCKETBUILDNUMBER, NETLIFY, VERCEL, CFBUILDID, SCREWDRIVER, SANDBOX), reads /proc/1/cgroup, /proc/1/cmdline, /proc/self/status (TracerPid) and /proc/self/maps for docker/containerd/kubepod/podman markers, and on Windows checks IsDebuggerPresent, CheckRemoteDebuggerPresent and scans running processes for analysis tools (wireshark, httpdebug, Process32First). The combination of a trivial cover-story API, undeclared native binaries loaded silently on import, an opaque sibling blob decrypted to a hidden /tmp staging path and executed under node, and sandbox/CI/debugger evasion gating is a load-time dropper that runs attacker-controlled code on the installer's host as soon as the package is required.

Affected Software

1 affected component

npm/strutil-helpers-core=1.0.1, =1.0.2, =1.0.4, =1.0.5, =1.0.3

Event History

Nov 11, 2026

Advisory Published

via OSV·08:54 PM

Data Sourced

via OSV·08:54 PM

DescriptionAffected Software

Frequently Asked Questions

Which environments are exposed when this dependency is used?

Node.js applications that require the package on Linux or Windows are exposed, because the package loads a platform-specific native addon on every require(). The described addons include Linux and Windows execution paths.

Does the suspicious native code require a special feature or configuration to load?

No special configuration is described. The package's index.js unconditionally attempts to load the appropriate native addon before defining its string-helper functions, and silently suppresses loading errors.

How can I check whether the installed package contains the described artifacts?

Inspect the installed strutil-helpers-core package directory for native .node addons and an opaque.napi_cache blob. The reported package includes a Linux ELF addon, a Windows PE addon, and the adjacent cache data used by the addon.

MAL-2026-19144: Malicious code in strutil-helpers-core (npm)

Affected Software

Event History

Frequently Asked Questions

Which environments are exposed when this dependency is used?

Does the suspicious native code require a special feature or configuration to load?

How can I check whether the installed package contains the described artifacts?

Company

Resources

Contact

Frequently Asked Questions

Which environments are exposed when this dependency is used?

Does the suspicious native code require a special feature or configuration to load?

How can I check whether the installed package contains the described artifacts?