Critical Malicious Code Vulnerability in @everreal/validate-esmoduleinterop-imports Package
Summary
MAL-2025-191216: Malicious code in @everreal/validate-esmoduleinterop-imports (npm). Affects @everreal/validate-esmoduleinterop-imports versions 1.4.4 – 1.4.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @everreal/validate-esmoduleinterop-imports package is an npm library designed to assist developers in validating ES module interop imports. It provides functionalities that streamline the import process for ES modules, ensuring compatibility and correctness. However, this package has been compromised, leading to severe security risks for any system that has it installed.
Vulnerability Detail
The vulnerability stems from a malicious code injection by the Sha1-Hulud: The Second Coming NPM worm. This worm is capable of stealing tokens and credentials, publishing them to GitHub, and propagating itself to other npm packages owned by the user. It establishes persistence through GitHub actions and may even destroy the user's home directory. Any system with this package installed is considered fully compromised, necessitating immediate action to secure sensitive information.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @everreal/validate-esmoduleinterop-importsIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users should uninstall the package using the command: npm uninstall @everreal/validate-esmoduleinterop-imports. Additionally, ensure that all sensitive information is rotated and monitored for any unauthorized access.
Conclusion
The @everreal/validate-esmoduleinterop-imports package has been compromised by a malicious worm, posing significant security risks. Users must act swiftly to remove the package, rotate sensitive information, and monitor their systems for any unauthorized access. Utilizing tools like Vulert can help in identifying vulnerabilities in your applications.
See every vulnerability recorded for @everreal/validate-esmoduleinterop-imports →
FAQ
The malicious code is designed to steal tokens and credentials, potentially leading to unauthorized access to user accounts and data.
If you have the @everreal/validate-esmoduleinterop-imports package installed, your system is likely compromised. It is advisable to take immediate action.
After uninstalling the package, rotate all secrets and keys stored on the affected system and monitor for any suspicious activity.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground without any signup.
Immediately change your passwords and tokens from a secure device, and enable two-factor authentication where possible.
