Malicious code in ts-utility-plus (npm)
The npm package ts-utility-plus contained malicious code in its default export that performs HTTPS requests to a hardcoded IP endpoint and executes arbitrary code via Function constructor with Node.js globals injected. The package was designed to deliver credential and browser-secret stealing payloads.
- Disclosed
- Last updated
- Blast radius
- Any Node.js application that imports ts-utility-plus and calls its default export getPlugin function
- Ecosystems
- Attack vectors
- Affected entities
- ts-utility-plusnpm package containing malicious code in default export
The npm package ts-utility-plus was found to contain malicious code in its default export function getPlugin. When called, the function performs an HTTPS request to a hardcoded bare-IP endpoint at https://31.97.137.157:45000/icons/109 and extracts the data.credits field from the response.\n\nThe malicious code then passes this response data into a dynamically constructed function via new Function('require','module',...) with Node.js globals including require, process, Buffer, and others injected as arguments. This allows arbitrary code execution within the installer's Node process whenever the package is required and its default export is invoked.\n\nThe package employed obfuscation tactics, using a cover-story of Font Awesome / icon CDN naming (including identifiers like IconProvider, iconDomain, and paths resembling /ajax/libs/font-awesome/...) to disguise the real malicious payload URL. The declared dependencies (@primno/dpapi, better-sqlite3, node-machine-id) are consistent with credential and browser-secret stealing functionality delivered through this attack vector.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- ts-utility-plus
- IPs
- 31.97.137.157
Remediation
- Remove ts-utility-plus from all projects immediately
- Audit all systems where ts-utility-plus was installed for signs of compromise, credential theft, or unauthorized access
- Review process execution logs and network connections from affected systems during the period the package was installed
- Rotate all credentials and secrets that may have been exposed on systems where the package was active
- Check for presence of @primno/dpapi, better-sqlite3, and node-machine-id packages which may indicate follow-on payload delivery
- Monitor for outbound connections to 31.97.137.157:45000 in network logs
Sources
- GitHub Advisory GHSA-32pr-r98g-6jmq · GitHub Advisory Database
Cite this entry
"Malicious code in ts-utility-plus (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 7, 2026; last updated August 7, 2026. https://supplychainattack.org/incident/malicious-code-in-ts-utility-plus-npm-gx0xd6
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malware in agent-bot-api
Malware was discovered in the npm package agent-bot-api. Systems with this package installed or running should be considered fully compromised and require immediate remediation.
npmCompromised package - resolvedcritical
Malware in @zynkit/jwtbytes
Malware was discovered in the npm package @zynkit/jwtbytes, resulting in full system compromise for any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package - containedcritical
Malware in leb128x
The npm package leb128x was found to contain malware that grants full system compromise to attackers. Any computer with this package installed or running should be considered fully compromised and all secrets and keys rotated immediately from a different machine.
npmCompromised package - containedcritical
Malware in envfile-sync-cli
Malware was discovered in the npm package envfile-sync-cli, providing full system compromise to any computer with the package installed or running. All secrets and keys on affected systems should be rotated immediately from a different computer.
npmCompromised package