{"answers":{"affected":"1 open source package ship an affected version, including fs-commons.","exploited":"There is no known exploitation of MAL-2026-17301 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-17301 is a malicious package in fs-commons, published on 29 Sep 2026."},"fix_prompt":"MAL-2026-17301 is a malicious package: fs-commons (npm). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-17301/ (Markdown: https://insights.sbomify.com/MAL-2026-17301/index.md)","id":"MAL-2026-17301","markdown":"https://insights.sbomify.com/MAL-2026-17301/index.md","name":"MAL-2026-17301","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The package presents itself as a filesystem/data-helper library, but its exported getTransactions()/load_transaction_data() functions are a two-file dynamic-code loader. index.js hides the identifiers 'Function', 'require', 'process', 'Buffer', and 'setTimeout' behind a split-string array and obtains the Function constructor indirectly via globalThis.constructor.constructor, defeating static review. At call time it reads the sibling file models.js, which is disguised as an array of product-record objects but whose `mark` fields are base64 ciphertext. loadConfig()/processData() sort the records by id, concatenate every `mark`, apply a per-count Caesar shift, base64-decode the result, and pass the resulting source to the Function constructor with Buffer, require, and process injected, then invoke it. Any consumer that requires fs-commons and calls getTransactions() executes attacker-supplied code with full Node privileges on the host process. The obfuscation, the indirect Function-constructor acquisition, and the disguising of the payload as product metadata in a sibling file have no legitimate purpose for a data-helper library and are the fingerprint of a supply-chain remote-code-execution package.","ecosystems":["npm"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in fs-commons (npm)","id":"MAL-2026-17301","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"npm","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"npm","fixed":[],"introduced":[],"last_affected":[],"package":"fs-commons","purl":"pkg:npm/fs-commons","source":"MAL-2026-17301"}],"products":null,"published":"2026-09-29","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-17301/"}