Loading npm security reports…
OpenSSF/OSV advisory MAL-2026-16363 confirms this npm version as malicious. The package advertises itself as string-formatting utilities but ships no formatter code. Its main entry `payload.js` is an IIFE that creates a `<script>` element with `src='https://xss.report/c/k3rne111'` and appends it to `document.body`, causing an attacker-controlled remote script to be fetched and executed whenever the module is loaded in a DOM context. xss.report is a known XSS payload-delivery service...
This report applies to blue-string-formatter-utilss@1.2.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Source advisory published: .