MAL-2026-16363 Malicious code in blue-string-formatter-utilss (npm)

The package advertises itself as string-formatting utilities but ships no formatter code. Its main entry payload.js is an IIFE that creates a <script> element with src='https://xss.report/c/k3rne111' and appends it to document.body, causing an attacker-controlled remote script to be fetched and executed whenever the module is loaded in a DOM context. xss.report is a known XSS payload-delivery service. The name-versus-behavior mismatch (a 'string formatter' whose only behavior is a remote script loader) is a typosquat cover story rather than legitimate functionality.