fcefi-wdojs-util npm package: malicious multi-stage dropper executes hidden payload on require, evades CI/sandboxes (no CVE)
Severity: critical · Patch status: no-fix-needed · Since 2026-11-11
fcefi-wdojs-util@1.0.0 on npm is malicious code with no legitimate utility function. Its index.js reads an undeclared bz numeric array (~1000 bytes) from its own package.json, zlib-inflates it, and executes the result via the Function constructor on every require. The loader short-circuits when CI, GITHUBACTIONS, GITLABCI, TRAVIS, CIRCLECI, or SANDBOX are set, so it stays inert in scanning environments and runs only on developer and production hosts. A 2.89 MB hex-only file, lib/native.pkgconfig, is consistent with an encrypted stage-2 payload. Any project that installed the package is exposed to arbitrary code execution; there are no patched versions, so removal is the only remediation.
What to do
- Remove fcefi-wdojs-util from all dependencies and lockfiles immediately
- Audit hosts where the package was installed for signs of execution and stage-2 payloads; treat credentials on those hosts as compromised
- Rotate secrets, tokens, and keys accessible from affected developer/production environments
- Check package-lock.json / CI caches for the package and block it in dependency firewalls
- Prefer lockfile pinning and provenance/allowlist checks for npm dependencies
Sources
All live incidents on Threat Watch
