Critical Malicious Code Vulnerability in @asyncapi/keeper Package
Summary
MAL-2025-190799: Malicious code in @asyncapi/keeper (npm). Affects @asyncapi/keeper versions 0.0.2 – 0.0.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @asyncapi/keeper package is a tool designed for managing and maintaining AsyncAPI specifications in JavaScript applications. It facilitates the development of APIs by providing a structured way to define and document them. However, this package has been identified to contain malicious code that compromises the security of any system it is installed on.
Vulnerability Detail
The vulnerability originates from the package being compromised with embedded malicious code, as identified by the source 'ghsa-malware'. Any system running this package is considered fully compromised, potentially allowing unauthorized access to sensitive information such as secrets and keys. The ramifications include complete control of the affected computer by an external entity, making it imperative for users to act swiftly to mitigate risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @asyncapi/keeperIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users should ensure that the package is removed from their systems. Additionally, they should monitor their systems for any unusual activity and consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The @asyncapi/keeper package has been compromised with malicious code, posing significant security risks to any system using it. Immediate action is required to uninstall the package and secure sensitive information. Users are encouraged to monitor their systems and consider alternative solutions.
See every vulnerability recorded for @asyncapi/keeper →
FAQ
You should immediately uninstall the package and rotate any sensitive information stored on your system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
Currently, there is no patched version available. Users are advised to uninstall the package.
Failure to address this vulnerability can lead to unauthorized access to your system and potential data breaches.
It is advisable to avoid using this package until it has been thoroughly reviewed and confirmed to be secure.
