Malicious Code Detected in @digift/cli: A Security Threat
Summary
MAL-2026-17187: Malicious code in @digift/cli (npm). Affects @digift/cli versions 99.99.100. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package @digift/cli is a Node.js command-line interface tool designed for various functionalities within the npm ecosystem. It allows developers to streamline their workflows and automate tasks. However, the specific version 99.99.100 has been flagged for malicious behavior, posing a significant security risk to users who have integrated it into their projects.
Vulnerability Detail
The vulnerability in @digift/cli arises from its communication with a domain associated with malicious activities. This behavior can lead to unauthorized data access, potential data breaches, and exploitation of the user's environment. The OpenSSF Package Analysis project identified this issue, emphasizing the need for immediate action to mitigate risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @digift/cliIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the @digift/cli package from their project until a secure version is confirmed. This can be done with the command: npm uninstall @digift/cli. Additionally, consider using alternative packages that provide similar functionalities without the associated risks.
Conclusion
The @digift/cli package version 99.99.100 has been identified as malicious, posing serious security risks to users. It is crucial to update or remove the package to protect your applications from potential threats. Utilizing tools like Vulert can help you stay informed about vulnerabilities in your open-source dependencies.
See every vulnerability recorded for @digift/cli →
FAQ
The package communicates with a domain linked to malicious activities, which can compromise user data and system integrity.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
If immediate updates are not possible, consider removing the package and using alternative solutions until a secure version is available.
While specific exploits have not been detailed, the potential for data breaches and unauthorized access is significant due to the package's behavior.
Regularly check vulnerability databases and use tools like Vulert to monitor your dependencies for any new vulnerabilities.
