Critical Remote Code Execution Vulnerability in @bitwardne/jslib Package
Summary
MAL-2026-17694: Malicious code in @bitwardne/jslib (npm). Affects @bitwardne/jslib versions 1.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @bitwardne/jslib package is a JavaScript library available on npm, which is a one-character typosquat of the legitimate @bitwarden scope. This package is designed to be installed via npm, and it is intended to provide utility functions. However, it has been found to contain malicious code that poses a significant security risk to users who install it.
Vulnerability Detail
The vulnerability originates from the package's preinstall lifecycle script, which executes a command to fetch and run a remote payload via curl. This script lacks any verification or integrity checks, allowing an attacker to execute arbitrary code on the installer's machine. The empty URL in the package's tarball indicates that any value placed there would lead to remote code execution, making it a severe security threat.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @bitwardne/jslibIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no effective workarounds for this vulnerability due to the nature of the malicious code. The best course of action is to avoid using the @bitwardne/jslib package altogether.
Conclusion
The @bitwardne/jslib package contains a critical vulnerability that allows for remote code execution due to its malicious preinstall script. Users are advised to uninstall this package immediately and monitor their applications for any potential impacts. Utilizing tools like Vulert can help in identifying vulnerabilities in your software.
See every vulnerability recorded for @bitwardne/jslib →
FAQ
A typosquat is a malicious package that mimics the name of a legitimate package with slight variations, often to trick users into installing it.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can check your application using the Vulert playground at Vulert Scanner without any signup.
If you have installed @bitwardne/jslib, you should uninstall it immediately using the command npm uninstall @bitwardne/jslib.
Yes, if the package is installed in your production environment, it can lead to remote code execution, compromising the security of your application.
Always verify the authenticity of packages before installation. Look for official sources and check the package's integrity to avoid similar issues.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
