Malicious code in hex-encode-utils (npm)

Source: amazon-inspector 999c0a7bda643ce11c335436392aac35c2eca53dc92225dd86cbc01cc9015f8c On npm install, scripts/compat.js runs as a postinstall hook and fetches an AES-256-GCM-encrypted blob over HTTPS from two hardcoded Cloudflare Workers hosts steel-mere-4155.ricardorichp.workers.dev,...

Malicious Package

Overview hex-encode-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-13695 Malicious code in hex-encode-utils (npm)

hex-encode-utils is a purpose-built npm trojan that masquerades as a zero-dependency hex encoding/decoding utility published by the npm account devroolx under the repo github.com/stdlib-utils/hex-encode-utils. It is a multi-stage downloader/loader that runs automatically on install via a...