Which versions of fmt-util-k7x2 are malicious?

The following npm versions of fmt-util-k7x2 are flagged malicious: 1.0.0, 1.0.1. Treat any of these as compromised.

How do I remediate fmt-util-k7x2 if I installed it?

fmt-util-k7x2 establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.

I already installed fmt-util-k7x2 — how do I know if it already compromised me?

If fmt-util-k7x2 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Is fmt-util-k7x2 part of a known attack campaign?

Yes — fmt-util-k7x2 is associated with the IN-MAL-2026-017650, IN-MAL-2026-017703 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find fmt-util-k7x2 across my projects, lockfiles, and CI pipelines?

Search your lockfiles and build artifacts for fmt-util-k7x2 (2 malicious versions).

Malicious package

fmt-util-k7x2npm

Advisory published Aug 13, 2026Updated Aug 13, 2026

fmt-util-k7x2 is a confirmed malicious npm package (MAL-2026-13950) that opens a backdoor for remote access (malicious versions 1.0.0, 1.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in fmt-util-k7x2 (npm)

MAL-2026-13950

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall fmt-util-k7x2

What this malware does

[email protected] advertises itself as a trivial string-formatting utility (index.js exports two-line pad/trim helpers), but its package.json declares a postinstall hook that runs setup.js on every npm install. setup.js probes a list of Twilio-internal hostnames (including code.hq.twilio.com, stage.twilio.com, twilio.jfrog.io, artifacts.twilio.com) and the AWS EC2 instance metadata endpoint at 169.254.169.254, then concatenates the per-target reachability results and sends them as a query string to a hardcoded external host at http://whstool.brkd.no/cb53e6db-e043-4383-89e9-853c9088ee5d?v=<results>. The per-install UUID callback identifies each victim uniquely, and the target set (internal corporate hostnames + cloud metadata service) matches the dependency-confusion reconnaissance pattern. The exfil destination is not owned by Twilio and is unrelated to the package's advertised purpose. The random-suffix name and mismatch between advertised functionality and postinstall behavior are consistent with a targeted dependency-confusion package aimed at Twilio build environments.

Malicious versions

2 flagged

1.0.01.0.1

Indicators of compromise (SHA-256)

0e8613ffc5393a31685344c247925a5ef104f7daf3f0d2f45a51918adba7d344

199c023d423783cbd5a697b3939d632b52e70029b86e59b63a69f4f298d39364

Detection & response playbook

Backdoor / remote access

Find it
Search your lockfiles and build artifacts for fmt-util-k7x2 (2 malicious versions).
If you installed it — respond
fmt-util-k7x2 establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.
Did it already run?
If fmt-util-k7x2 was installed, its post-install payload may already have run. Removing the package does not undo that — check outbound connections and credential use from the install window onward.

Frequently asked questions

No. fmt-util-k7x2 on npm has been identified as a malicious package (versions 1.0.0, 1.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-017650IN-MAL-2026-017703

References

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks fmt-util-k7x2-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database