Which versions of fmt-util-k7x2 are malicious?

The following npm versions of fmt-util-k7x2 are flagged malicious: 1.0.1. Treat any of these as compromised.

How do I remediate fmt-util-k7x2 if I installed it?

fmt-util-k7x2 establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.

I already installed fmt-util-k7x2 — how do I know if it already compromised me?

If fmt-util-k7x2 was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.

Is fmt-util-k7x2 part of a known attack campaign?

Yes — fmt-util-k7x2 is associated with the IN-MAL-2026-017650 campaign. Packages in the same campaign often share infrastructure and payloads, so check whether any related packages are also in your dependency tree.

How do I find fmt-util-k7x2 across my projects, lockfiles, and CI pipelines?

Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for fmt-util-k7x2 (version 1.0.1). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging fmt-util-k7x2 across your stack and pipelines.

Malicious package

fmt-util-k7x2npm

fmt-util-k7x2 is a confirmed malicious npm package (MAL-2026-13950) that opens a backdoor for remote access (malicious version 1.0.1). Do not install it — remove it immediately and rotate any exposed credentials.

Malicious code in fmt-util-k7x2 (npm)

MAL-2026-13950

Immediate action

Remove the package, then rotate any secrets the build/runtime could reach.

npm uninstall fmt-util-k7x2

What this malware does

[email protected] advertises itself as a trivial string-formatting utility (index.js exports two-line pad/trim helpers), but its package.json declares a postinstall hook that runs setup.js on every npm install. setup.js probes a list of Twilio-internal hostnames (including code.hq.twilio.com, stage.twilio.com, twilio.jfrog.io, artifacts.twilio.com) and the AWS EC2 instance metadata endpoint at 169.254.169.254, then concatenates the per-target reachability results and sends them as a query string to a hardcoded external host at http://whstool.brkd.no/cb53e6db-e043-4383-89e9-853c9088ee5d?v=<results>. The per-install UUID callback identifies each victim uniquely, and the target set (internal corporate hostnames + cloud metadata service) matches the dependency-confusion reconnaissance pattern. The exfil destination is not owned by Twilio and is unrelated to the package's advertised purpose. The random-suffix name and mismatch between advertised functionality and postinstall behavior are consistent with a targeted dependency-confusion package aimed at Twilio build environments.

Malicious versions

1 flagged

1.0.1

Indicators of compromise (SHA-256)

0e8613ffc5393a31685344c247925a5ef104f7daf3f0d2f45a51918adba7d344

Detection & response playbook

Backdoor / remote access

Find it
Scan your lockfiles (package-lock.json, pnpm-lock.yaml, yarn.lock, requirements.txt, poetry.lock, etc.) and build artifacts for fmt-util-k7x2 (version 1.0.1). O3 Security's supply-chain scanner checks every dependency against known-malicious package intelligence at install time and in CI, flagging fmt-util-k7x2 across your stack and pipelines.
If you installed it — respond
fmt-util-k7x2 establishes remote access, so treat any host that installed it as fully compromised. Isolate the machine, remove the package, rotate all credentials it could reach, and rebuild from a trusted image rather than cleaning in place — a backdoor may have planted additional persistence.
Did it already run?
If fmt-util-k7x2 was ever installed, its post-install/runtime payload may have already executed. O3's L7 egress monitoring and runtime eBPF sensors detect the credential exfiltration or command-and-control callback after install and block the malicious outbound channel, so you catch and contain the actual compromise — not just the presence of the package.
How O3 protects you
O3 blocks fmt-util-k7x2 before install through its supply-chain scanner, and if it has already run, detects and severs the exfiltration or C2 callback at runtime through L7 egress monitoring and eBPF.

Frequently asked questions

No. fmt-util-k7x2 on npm has been identified as a malicious package (version 1.0.1 flagged). It should be removed immediately — do not install or keep it in your dependency tree.

Campaign

IN-MAL-2026-017650

References

npmjs.com

Credits

Amazon Inspector · finder

Detect & block this

O3 blocks fmt-util-k7x2-class packages before install and in CI — and if it already ran, its runtime egress monitoring catches the C2 callback and severs the channel.

Malware detection Runtime egress monitoring

Explore

All malware advisories How O3 detects malware Vulnerability database