{"id":"MAL-2026-17418","revision":"c748464d50b24bf8a8e06dca80b3eca5","records":[{"revision":"c748464d50b24bf8a8e06dca80b3eca5","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17418","aliases":[],"title":"Malicious code in future-scripts (npm)","description":"On October 10, 2026 (local time), boom() calls localStorage.setItem('key', i) 100,000,000 times in a synchronous loop, potentially freezing a browser page. In version 0.0.2, the exported getCommonDateInRanges() calls boom() before input validation; the bundled source map confirms this path. Version 0.0.3 retains boom() as a separate export but no longer calls it from getCommonDateInRanges(), so an explicit call is required. Version 0.0.1 does not contain this routine. This is a static finding; actual victim impact was not observed.","state":0,"publishedAt":"2026-09-30T00:13:16+00:00","modifiedAt":"2026-10-01T05:45:04.1991458+00:00","affected":[{"ecosystem":"npm","name":"future-scripts","ranges":[],"versions":["0.0.2","0.0.3"],"rawVersionEvidence":null}],"metrics":[],"references":[],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17418","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17418","identifiers":["MAL-2026-17418"]},"retained":false,"historicalAffected":[]}],"coverage":[]}