Critical Malicious Code Vulnerability in @gr-exports/head Package
Summary
MAL-2025-191562: Malicious code in @gr-exports/head (npm). Affects @gr-exports/head versions 1.0.0 – 99.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @gr-exports/head package is a JavaScript library commonly used in Node.js applications to manage and manipulate the document head, including meta tags, title, and links. It is designed to enhance the SEO and usability of web applications. However, it has been identified as containing malicious code, which poses a significant risk to users and their applications.
Vulnerability Detail
The vulnerability in the @gr-exports/head package stems from the inclusion of malicious code that can compromise the integrity of applications utilizing this package. This malicious code can lead to unauthorized access, data breaches, or the execution of harmful scripts within the user's environment. The affected versions are 1.0.0 and 99.0.0, which have been flagged for their potential to introduce security risks.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @gr-exports/headIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider removing the @gr-exports/head package from your project until a secure version is released. This can be done using the command: npm uninstall @gr-exports/head. Additionally, monitor your application for any suspicious behavior that may arise from using the affected package.
Conclusion
The @gr-exports/head package has been identified as containing malicious code, posing a significant risk to applications that utilize it. Users are advised to update to a secure version or remove the package until a fix is available. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for @gr-exports/head →
FAQ
The @gr-exports/head package is a library for managing the document head in Node.js applications, allowing developers to manipulate meta tags and other head elements.
The affected versions are 1.0.0 and 99.0.0, which contain malicious code that can compromise application security.
You can use Vulert, a tool that monitors and alerts for open-source vulnerabilities in real-time. By analyzing your package-lock.json file, Vulert can help identify if your application is affected.
Yes, you can temporarily uninstall the @gr-exports/head package or replace it with an alternative package until a secure version is available.
Detailed information can be found on the GitHub repository of the malicious packages, as well as through security advisories related to npm packages.
