Critical Malicious Code Vulnerability in @accordproject/markdown-cli Package
Summary
MAL-2025-191449: Malicious code in @accordproject/markdown-cli (npm). Affects @accordproject/markdown-cli versions 0.16.20-20251124101628. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @accordproject/markdown-cli package is a tool designed for converting Markdown documents into other formats, primarily used in Accord Project applications. It is part of a larger ecosystem that facilitates smart contracts and legal documents. However, this package has been compromised, leading to significant security concerns for users who have it installed.
Vulnerability Detail
The vulnerability stems from the presence of malicious code within the @accordproject/markdown-cli package, identified as version 0.16.20-20251124101628. This code can fully compromise any computer where the package is installed, allowing unauthorized access to sensitive information such as secrets and keys. The origin of this malicious code is linked to a known malware source, and its implications are severe, as it may grant attackers complete control over affected systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @accordproject/markdown-cliIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can consider using alternative Markdown conversion tools that are not affected by this vulnerability. However, the best course of action remains the complete removal of the @accordproject/markdown-cli package.
Conclusion
The @accordproject/markdown-cli package has been compromised with malicious code, posing a serious threat to users. Immediate action is required to uninstall the package and secure any sensitive information. Users are encouraged to monitor their systems and consider alternative tools until a safe version is available.
See every vulnerability recorded for @accordproject/markdown-cli →
FAQ
You should immediately uninstall the package and rotate any sensitive information stored on your system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
No, there is currently no patched version available for the @accordproject/markdown-cli package.
Failing to address this vulnerability can lead to unauthorized access to sensitive data and complete control of your system by malicious actors.
It is highly recommended to avoid using the @accordproject/markdown-cli package until the vulnerability is resolved and a safe version is released.
