{
  "title": "buffer-utilities: Lazarus Group npm Brandjacking Dropper",
  "summary": "Sonatype and JFrog describe buffer-utilities as a malicious npm brandjacking package in a Lazarus Group campaign; the package acts as a dropper that fetches and launches remote payloads.",
  "date": "2026-06-18",
  "severity": "high",
  "tags": [
    "npm",
    "node",
    "supply-chain",
    "brandjacking",
    "lazarus-group"
  ],
  "sources_count": 3,
  "indicators": {
    "slug": "sonatype-2026-003558-buffer-utilities",
    "since": "2026-06-03T00:00:00Z",
    "until": "unknown",
    "ecosystem": "npm",
    "cves": [],
    "cwes": [],
    "advisoryIds": [],
    "products": [
      "buffer-utilities",
      "buffer",
      "buffer-util-extend",
      "express-denv",
      "jwt-path",
      "webpack-patch",
      "chai-as-patch",
      "chai-beta",
      "react-next-dom"
    ],
    "packages": [
      "buffer-utilities",
      "buffer",
      "buffer-util-extend",
      "express-denv",
      "jwt-path",
      "webpack-patch",
      "chai-as-patch",
      "chai-beta",
      "react-next-dom"
    ],
    "versions": [
      "buffer-utilities@1.0.0",
      "buffer-utilities@1.1.0",
      "buffer-utilities@1.1.1"
    ],
    "affectedVersions": [
      "buffer-utilities@1.0.0",
      "buffer-utilities@1.1.0",
      "buffer-utilities@1.1.1"
    ],
    "fixedVersions": [],
    "files": [
      "setup.cjs",
      ".vscode",
      ".pkg_history",
      ".pkg_logs"
    ],
    "paths": [],
    "services": [],
    "domains": [
      "registry.npmjs.org"
    ],
    "urls": [
      "https://registry.npmjs.org/buffer-utilities",
      "https://registry.npmjs.org/buffer-utilities/-/buffer-utilities-1.0.0.tgz",
      "https://registry.npmjs.org/buffer-utilities/-/buffer-utilities-1.1.0.tgz",
      "https://registry.npmjs.org/buffer-utilities/-/buffer-utilities-1.1.1.tgz",
      "https://registry.npmjs.org/buffer-utilities/-/buffer-utilities-0.0.1-security.tgz"
    ],
    "ips": [],
    "hashes": [],
    "processPatterns": [
      "postinstall",
      "node setup.cjs --no-warnings",
      "spawn(process.execPath, ..., detached: true)"
    ],
    "networkPatterns": [
      "registry.npmjs.org/buffer-utilities",
      "buffer-utilities-1.0.0.tgz",
      "buffer-utilities-1.1.0.tgz",
      "buffer-utilities-1.1.1.tgz"
    ],
    "telemetrySelectors": []
  }
}