Malicious Code Injection in blue-string-formatter-utilss Package
Summary
MAL-2026-16363: Malicious code in blue-string-formatter-utilss (npm). Affects blue-string-formatter-utilss versions 1.2.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The blue-string-formatter-utilss package is advertised as a utility for string formatting in JavaScript applications. However, it lacks any legitimate string formatting functionality and instead serves as a conduit for malicious code. This discrepancy raises significant security concerns, as the package can be exploited to execute harmful scripts in a user's environment.
Vulnerability Detail
The vulnerability originates from the package's main entry file, payload.js, which is an Immediately Invoked Function Expression (IIFE). This file dynamically creates a <script> element that loads a remote script from a known XSS payload delivery service, xss.report. When the module is loaded in a DOM context, it allows an attacker to execute arbitrary code, leading to potential data breaches, unauthorized access, and other security risks. The mismatch between the package's name and its actual behavior indicates a deliberate attempt to mislead users.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall blue-string-formatter-utilssIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the blue-string-formatter-utilss package in your application. If you require string formatting utilities, consider using well-known and trusted alternatives such as lodash or sprintf-js, which do not exhibit malicious behavior.
Conclusion
The blue-string-formatter-utilss package poses a significant security threat due to its malicious code that executes remote scripts. Users are advised to remove this package and consider safer alternatives. Regular monitoring of dependencies is essential to maintain application security.
See every vulnerability recorded for blue-string-formatter-utilss →
FAQ
It is a JavaScript package that falsely claims to provide string formatting utilities but instead contains malicious code.
The vulnerability works by loading a remote script from an attacker-controlled source whenever the package is loaded in a DOM context.
The risks include unauthorized access to sensitive data, execution of arbitrary code, and potential data breaches.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner without any signup.
Immediately uninstall the package and replace it with a trusted alternative. Regularly monitor your dependencies for vulnerabilities.
