Critical Malicious Code Vulnerability in @clausehq/flows-step-httprequest Package
Summary
MAL-2025-191201: Malicious code in @clausehq/flows-step-httprequest (npm). Affects @clausehq/flows-step-httprequest versions 0.1.14. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @clausehq/flows-step-httprequest package is an npm module designed to facilitate HTTP requests within workflows. It is commonly used in automation and integration tasks. However, this package has been compromised, leading to severe security risks for users who have it installed.
Vulnerability Detail
The vulnerability stems from a malicious code injection by the Sha1-Hulud: The Second Coming NPM worm. This worm is designed to steal tokens and credentials, publishing them to GitHub. It can propagate itself to other NPM packages owned by the user and establish persistence through GitHub actions. Additionally, it poses a risk of destroying the user's home directory, making it critical for users to take immediate action.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @clausehq/flows-step-httprequestIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users should consider isolating their development environments and using containerization tools to minimize the risk of exposure. Additionally, they can monitor their systems for any unusual activity that may indicate the presence of the malicious code.
Conclusion
The @clausehq/flows-step-httprequest package has been compromised, leading to significant security risks. Users are urged to remove the package immediately and take necessary precautions to secure their systems. Utilizing tools like Vulert can help monitor for vulnerabilities in the future.
See every vulnerability recorded for @clausehq/flows-step-httprequest →
FAQ
You should immediately remove the package and rotate any secrets or keys stored on your computer.
The malicious code can steal sensitive information, propagate to other packages, and potentially destroy your home directory.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without any signup.
Failing to address this vulnerability can lead to unauthorized access to your sensitive information and control over your development environment.
To prevent future vulnerabilities, regularly update your packages, monitor for security alerts, and use tools like Vulert for real-time vulnerability tracking.
