Critical Malicious Code Vulnerability in @freeday-ai/webchat Package
Summary
MAL-2025-191454: Malicious code in @freeday-ai/webchat (npm). Affects @freeday-ai/webchat versions 2025.11.2-4.7.32.11335 – 2025.11.2-4.9.17.4962. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @freeday-ai/webchat package is an npm library designed to facilitate web chat functionalities for applications. It offers features such as real-time messaging, user interaction, and integration with various web services. However, it has been found to contain malicious code that compromises the security of systems using this package.
Vulnerability Detail
The vulnerability stems from the presence of embedded malicious code within the @freeday-ai/webchat package. This code can fully compromise any computer that has the package installed or running, potentially allowing unauthorized access to sensitive information such as secrets and keys. The malicious nature of the code is classified under CWE-506, indicating that it appears to be intentionally harmful. Users are advised to treat any system with this package as compromised.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @freeday-ai/webchatIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, the best workaround is to uninstall the @freeday-ai/webchat package. You can do this by running the following command in your terminal: npm uninstall @freeday-ai/webchat. Ensure that you also check for any other dependencies that may be affected.
Conclusion
The @freeday-ai/webchat package has been identified as containing malicious code that poses a significant security risk. Immediate action is required to uninstall the package and secure any sensitive information. Users are encouraged to utilize tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for @freeday-ai/webchat →
FAQ
You should immediately uninstall the package and rotate any sensitive information stored on the affected system.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without requiring any signup.
Failing to address this vulnerability could lead to unauthorized access to your system, data breaches, and potential loss of sensitive information.
The best mitigation strategy is to uninstall the affected package and ensure that your system is secure by rotating any compromised secrets.
While removing the package is essential, there is no guarantee that all malicious software will be removed. It is advisable to conduct a thorough security audit of your system.
