Critical Malicious Code Vulnerability in @gr-exports/async Package
Summary
MAL-2025-191560: Malicious code in @gr-exports/async (npm). Affects @gr-exports/async versions 1.0.0 – 99.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @gr-exports/async package is a JavaScript library available on npm that provides asynchronous utilities for developers. It is designed to simplify the handling of asynchronous operations in JavaScript applications. However, this package has been identified to contain malicious code that poses significant security risks to applications that utilize it.
Vulnerability Detail
The vulnerability stems from the inclusion of malicious code within the @gr-exports/async package. This code can potentially compromise the security of applications by executing unauthorized actions or accessing sensitive data. The malicious code was identified in versions 1.0.0 and 99.0.0 of the package, and it is crucial for developers to be aware of the risks associated with using these versions.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @gr-exports/asyncIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If you cannot immediately update the package, consider removing it from your project or replacing it with a similar library that does not have known vulnerabilities. Additionally, you can monitor your project for any suspicious activity until the package is updated.
Conclusion
The @gr-exports/async package has a critical vulnerability due to the presence of malicious code in specific versions. It is essential for developers to update to a secure version or implement workarounds to mitigate risks. Utilizing tools like Vulert can help in monitoring for such vulnerabilities in real-time.
See every vulnerability recorded for @gr-exports/async →
FAQ
The malicious code can execute unauthorized actions within applications, potentially leading to data breaches or other security incidents.
Versions 1.0.0 and 99.0.0 of the @gr-exports/async package are known to contain the malicious code.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without requiring a signup.
Consider removing the package or replacing it with a secure alternative while monitoring your application for any suspicious activity.
The vulnerability was reported by ReversingLabs, a cybersecurity firm specializing in threat detection.
