Malicious Code Vulnerability in future-scripts: Potential Browser Freeze
Summary
MAL-2026-17418: Malicious code in future-scripts (npm). Affects future-scripts versions 0.0.2 – 0.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'future-scripts' package is an npm library designed to facilitate script execution and management in JavaScript applications. It provides various utilities for developers, enhancing productivity and code organization. However, a critical vulnerability has been identified in specific versions of this package, which could lead to severe performance issues in web applications.
Vulnerability Detail
On October 10, 2026, a function named boom() within the future-scripts package was found to call localStorage.setItem('key', i) 100,000,000 times in a synchronous loop. This behavior can potentially freeze a browser page, leading to a poor user experience. The vulnerability arises from the exported function getCommonDateInRanges() in version 0.0.2, which calls boom() without proper input validation. Although version 0.0.3 separates boom() as an export, it no longer calls it from getCommonDateInRanges(), requiring explicit invocation. Version 0.0.1 does not contain this routine, thus is not affected. The static nature of this finding indicates that while the potential for impact exists, actual exploitation has not been observed.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall future-scriptsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider removing or commenting out any calls to the boom() function in your codebase to prevent potential freezing of the browser. Ensure to validate inputs before invoking any functions that may lead to resource exhaustion.
Conclusion
The future-scripts package has a critical vulnerability that can lead to browser freezing due to excessive resource consumption. It is crucial for developers using this package to update to the latest version or implement workarounds to mitigate risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for future-scripts →
FAQ
The vulnerability involves a function that can cause excessive resource consumption, potentially freezing the browser.
Versions 0.0.2 and earlier are affected. Version 0.0.3 mitigates the issue by not calling the problematic function from getCommonDateInRanges().
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without requiring any signup.
As a temporary measure, you can comment out or remove calls to the boom() function in your code to prevent potential issues.
While the potential for impact exists, actual victim impact has not been observed at this time.
