Malicious Code Detected in @f5rest/odata-v4-inmemory Package - Security Alert
Summary
MAL-2026-1619: Malicious code in @f5rest/odata-v4-inmemory (npm). Affects @f5rest/odata-v4-inmemory versions 99.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @f5rest/odata-v4-inmemory package is a Node.js library designed for in-memory data storage and manipulation, particularly for OData v4 services. It allows developers to create and manage data models efficiently within their applications. However, this package has been identified to contain malicious code, posing significant security risks to applications that utilize it.
Vulnerability Detail
The vulnerability originates from a malicious code injection in version 99.0.0 of the @f5rest/odata-v4-inmemory package. This code can potentially compromise the integrity of applications using this package, leading to unauthorized access, data breaches, or other malicious activities. The specific technical details of the malicious code have not been disclosed, but its presence in the package is a serious concern for developers relying on this library.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @f5rest/odata-v4-inmemoryIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider removing the @f5rest/odata-v4-inmemory package from your project until a secure version is released. You can do this by running: npm uninstall @f5rest/odata-v4-inmemory.
Conclusion
The @f5rest/odata-v4-inmemory package has been identified to contain malicious code, posing a significant security risk. It is essential for developers to update or remove the package to protect their applications. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for @f5rest/odata-v4-inmemory →
FAQ
The malicious code is designed to compromise application security, but specific details about its functionality have not been disclosed.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
Consider removing the package from your project until a secure version is available to mitigate risks.
Yes, using Vulert, you can monitor your project's dependencies for vulnerabilities in real-time by analyzing your package-lock.json.
Using the compromised package can lead to unauthorized access, data breaches, and other malicious activities that can severely impact your application and its users.
