strutil-helpers-core (npm): malicious load-time dropper with sandbox evasion executes attacker code on require
Severity: critical · Patch status: no-fix-needed · Since 2026-11-11
The npm package strutil-helpers-core, advertised as lightweight string utilities (trim/capitalize/truncate), is malicious. Versions 1.0.1–1.0.5 ship undeclared native addons (Linux ELF and Windows PE .node files) plus a 3.7MB opaque .napicache blob. On require(), index.js silently loads the platform addon, which decrypts JavaScript staged to hidden /tmp paths (/tmp/.%u, %s.nc%lu.js) and executes it under node via fork/execlp on Linux or CreateProcessA on Windows. Before firing, it checks CI/sandbox indicators (GITHUBACTIONS, JENKINSURL, etc.), container markers via /proc, and debugger/analysis-tool presence on Windows, evading analysis. This is a load-time dropper running attacker-controlled code on any host that installs and requires the package. No patched versions exist; the package should be removed entirely.
What to do
- Remove strutil-helpers-core from all dependency trees and lockfiles immediately; do not use any version
- Audit hosts and CI runners that installed or required the package for staged files matching /tmp/.<pid> and *.nc*.js patterns and for post-install persistence
- Rotate credentials, tokens, and secrets accessible from affected build machines and developer hosts
- Check npm audit / lockfile history to identify when the package was introduced and what else may have run in those environments
- Block the package name in internal registries and dependency firewall policies
Sources
All live incidents on Threat Watch
