future-scripts@0.0.3: Malicious npm security report (Block)

OSV Malicious Advisory

imported 7d ago · by OpenSSF/OSV

OpenSSF/OSV advisory MAL-2026-17418 confirms this npm version as malicious. On October 10, 2026 (local time), boom() calls localStorage.setItem('key', i) 100,000,000 times in a synchronous loop, potentially freezing a browser page. In version 0.0.2, the exported getCommonDateInRanges() calls boom() before input validation; the bundled source map confirms this path. Version 0.0.3 retains boom() as a separate export but no longer calls it from getCommonDateInRanges(), so an explicit call is...

Advisory

MAL-2026-17418

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in future-scripts (npm)

Details

On October 10, 2026 (local time), boom() calls localStorage.setItem('key', i) 100,000,000 times in a synchronous loop, potentially freezing a browser page. In version 0.0.2, the exported getCommonDateInRanges() calls boom() before input validation; the bundled source map confirms this path. Version 0.0.3 retains boom() as a separate export but no longer calls it from getCommonDateInRanges(), so an explicit call is required. Version 0.0.1 does not contain this routine. This is a static finding; actual victim impact was not observed.

Decision reason

OpenSSF Malicious Packages via OSV confirms future-scripts@0.0.3 as malicious (MAL-2026-17418): Malicious code in future-scripts (npm)

References

OSV advisory

Source & flagged code

0 flagged

No flagged code excerpts are attached to this scan.

Source & flagged code

0 flagged · loading source

No flagged code excerpts are attached to this scan.

future-scripts@0.0.3

OSV Malicious Advisory

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code