LWA-2026-5511 confirmed malware
winutils-fetch@2.0.0
Malicious code in winutils-fetch (npm)
T1195.002 · Compromise Software Supply ChainT1059.007 · JavaScriptT1105 · Ingress Tool Transfer
Analysis
Package winutils-fetch@2.0.0 is a trojanized combosquat impersonating a Windows-utilities naming pattern. Its index.js exports a harmless figlet ASCII-art function (decoy). The real payload is in the postinstall hook and dependency chain: on install, the script runs "npm i win-utils-helper" which pulls in a known-malware package. The package also declares a self-dependency (winutils-fetch@^1.0.0) as a confusion marker. Installing this package will automatically download and install the win-utils-helper malware via the npm lifecycle.
- analyzed by
- Leitwacht
- first seen
- Jun 16, 2026, 04:28 AM
- analyzed
- Jun 16, 2026, 04:29 AM
Related advisories
- winston-prism@1.0.1
- wind_css@4.0.13
- pretie_x2@3.8.5
- pretie_x1@3.8.5
- web-pool@2.3.5
- wordpad-text-ui@1.0.0
- webpack-cdn-fetcher@1.0.1
- weavedb-node-client@0.45.3
Independently detected by the Leitwacht supply-chain probe. IOCs are defanged. Published CC0. Think this is a mistake? See the dispute policy.