MAL-2026-18194: Malicious code in @lumen-labs-dev/whisper-node
Summary
MAL-2026-18194: The package contains malicious code that may give an outside entity full control of a computer where it is installed or running. Affects @lumen-labs-dev/whisper-node versions 0.5.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
@lumen-labs-dev/whisper-node is an npm package written in JavaScript. The supplied advisory identifies it as containing malicious code but does not describe its intended functionality or where it is used. The advisory warns that a computer with the package installed or running should be treated as fully compromised.
Vulnerability Detail
The package contains embedded malicious code, which may give an outside entity full control of a computer where it is installed or running. The advisory identifies the affected package version as 0.5.1. Secrets and keys stored on the computer may be exposed, and removing the package alone may not remove other malicious software resulting from its installation.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @lumen-labs-dev/whisper-nodeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Documented workaround: Remove @lumen-labs-dev/whisper-node and rotate all secrets and keys stored on the affected computer immediately, using a different computer. Treat the affected computer as fully compromised; removal alone may not eliminate other malicious software.
Conclusion
No fixed version is published for @lumen-labs-dev/whisper-node. Remove it and treat any computer where it was installed or running as fully compromised. Rotate stored secrets and keys from a different computer; package removal alone may not eliminate other malicious software. Vulert monitors the dependencies in package-lock.json and alerts when a new vulnerability affects them; check an application at https://vulert.com/scanner.
See every vulnerability recorded for @lumen-labs-dev/whisper-node →
FAQ
@lumen-labs-dev/whisper-node version 0.5.1 is identified as malicious in the supplied advisory.
@lumen-labs-dev/whisper-node may give an outside entity full control of a computer where it is installed or running.
No fixed version is published for @lumen-labs-dev/whisper-node; remove the package and follow the documented response.
Treat the computer as fully compromised, restrict its use, and rotate stored secrets and keys from a different computer.
Check package-lock.json manually for @lumen-labs-dev/whisper-node. Vulert can scan a manifest or SBOM and monitor the dependency at Vulert Scanner.
