# MAL-2026-12791: Malicious code in gs-uitk-object-utils (npm)


- **Type:** Malicious package
- **Package:** `gs-uitk-object-utils` (npm)
- **Published:** 5 Aug 2026

## What is MAL-2026-12791?

MAL-2026-12791 is a malicious package in gs-uitk-object-utils, published on 5 Aug 2026. 

### Official description

package.json declares scripts.install: `node index.js`, which requires `./lib/core`. lib/core.js reads the OS username, hostname, and current working-directory basename, assembles them with a hardcoded `goldman1` prefix into a subdomain of `oob.sl4x0.xyz`, and issues a `dns.resolve4` lookup against that name, causing the installer's host identifiers to be transmitted as a DNS query to the attacker-controlled authoritative server. The destination domain, prefix, and API names (`os`, `dns`, `userInfo`, `hostname`, `cwd`, `resolve4`) are stored as char-code arrays in lib/b02e30.js and lib/6ad264.js and decoded at runtime via String.fromCharCode, concealing the exfiltration path. The same code also fires on `require()` of the package. The package presents itself as an object-utility library, which does not match the observed install-time DNS beaconing.

## What should I do about MAL-2026-12791?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-12791 is a malicious package: gs-uitk-object-utils (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-12791/ (Markdown: https://insights.sbomify.com/MAL-2026-12791/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-12791

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-12791/
Summaries are generated and may contain mistakes; the official description above is the record.