# MAL-2026-17301: Malicious code in fs-commons (npm)


- **Type:** Malicious package
- **Package:** `fs-commons` (npm)
- **Published:** 29 Sep 2026

## What is MAL-2026-17301?

MAL-2026-17301 is a malicious package in fs-commons, published on 29 Sep 2026. 

### Official description

The package presents itself as a filesystem/data-helper library, but its exported getTransactions()/load_transaction_data() functions are a two-file dynamic-code loader. index.js hides the identifiers 'Function', 'require', 'process', 'Buffer', and 'setTimeout' behind a split-string array and obtains the Function constructor indirectly via globalThis.constructor.constructor, defeating static review. At call time it reads the sibling file models.js, which is disguised as an array of product-record objects but whose `mark` fields are base64 ciphertext. loadConfig()/processData() sort the records by id, concatenate every `mark`, apply a per-count Caesar shift, base64-decode the result, and pass the resulting source to the Function constructor with Buffer, require, and process injected, then invoke it. Any consumer that requires fs-commons and calls getTransactions() executes attacker-supplied code with full Node privileges on the host process. The obfuscation, the indirect Function-constructor acquisition, and the disguising of the payload as product metadata in a sibling file have no legitimate purpose for a data-helper library and are the fingerprint of a supply-chain remote-code-execution package.

## What should I do about MAL-2026-17301?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-17301 is a malicious package: fs-commons (npm). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-17301/ (Markdown: https://insights.sbomify.com/MAL-2026-17301/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-17301

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-17301/
Summaries are generated and may contain mistakes; the official description above is the record.