LWA-2026-5200 confirmed malware
string-utils-kit@1.0.0
Malicious code in string-utils-kit (npm)
T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1204.002 · Malicious FileT1564.003 · Hidden WindowT1543 · Create or Modify System Process
Analysis
Package string-utils-kit@1.0.0 masquerades as a string utility library but executes a hidden binary on install. The postinstall hook (bin/setup.js) spawns assets/setup-helper.exe (a 9.84MB Windows PE executable) with detached:true, windowsHide:true, and child.unref() — launching it silently in the background without the installer's knowledge. The library code in dist/index.js is a decoy; the real payload is the bundled executable.
- analyzed by
- Leitwacht
- first seen
- Jun 14, 2026, 08:32 AM
- analyzed
- Jun 14, 2026, 08:33 AM
Related advisories
- pocbitbarrontest@1.0.0
- metrica-node@2.4.5
- streak-map-kit@1.0.0
- dolyame-ui-inputtime@35.8.1
- dolyame-boxy-fonts@35.4.8
- dolyame-ui-radio@35.2.2
- bnpl-blocks-atom-bnpl-button@35.4.7
- twork-products-taiga2-products-timeline@20.6.1
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.