loader-utils-kit
This report shows the evidence for loader-utils-kit@4.3.5. 2 of 3 known versions are blocked or flagged. See all versions.
OpenSSF/OSV Malicious Advisory
imported 2h ago · by OpenSSF/OSVOpenSSF/OSV advisory MAL-2026-18689 confirms this npm version as malicious.
Independent LPM AI assessment
SuspiciousIndependent AI assessment: suspicious. LPM AI assessed this version as suspicious; the assessments disagree.
The obfuscated dynamic execution in lib/contract.js is a real unresolved capability, but the inspected source does not establish malicious behavior. The package manifest has no install hook, and the package entrypoint does not directly invoke the payload.
Independent scan evidence
public snapshot- lib/contract.js uses string-scrambling and dynamically constructed functions to reconstruct and run hidden code when contract() is called.
- lib/index.js calls contract() only inside chain() and reassigns exports before adding the remaining API properties, so the package entrypoint does not directly invoke the hidden code.
- package.json declares no install lifecycle hook.
- The inspected code does not establish the hidden payload's behavior or identify a network recipient.
- The hidden code is not invoked directly by the package entrypoint.
Source & flagged code
6 flaggedPackage source references weak cryptographic algorithms.
lib/getHashDigest.jsView on unpkg · L45Source contains an obfuscated payload loader that reconstructs and executes hidden code.
lib/contract.jsView on unpkg · L2lib/contract.js uses string-scrambling and dynamically constructed functions to reconstruct and run hidden code when contract() is called.
lib/contract.jsView on unpkg · L4lib/contract.js uses string-scrambling and dynamically constructed functions to reconstruct and run hidden code when contract() is called.
lib/contract.jsView on unpkg · L4lib/index.js calls contract() only inside chain() and reassigns exports before adding the remaining API properties, so the package entrypoint does not directly invoke the hidden code.
lib/index.jsView on unpkg · L8package.json declares no install lifecycle hook.
package.jsonView on unpkg · L7Findings
Affected versions and remediation
This report applies to loader-utils-kit@4.3.5.
The versions list below shows the verdict for each recorded version.
- Avoid installing loader-utils-kit@4.3.5. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.