Malicious Code Vulnerability in @panopto/api-core Package
Summary
MAL-2026-1634: Malicious code in @panopto/api-core (npm). Affects @panopto/api-core versions 99.98.5 – 99.98.6. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @panopto/api-core package is a library used in Node.js applications to interact with Panopto's API. It provides developers with essential tools to manage video content and integrate with Panopto's services. However, this package has been identified as having a vulnerability that could allow malicious code execution, posing a risk to applications that depend on it.
Vulnerability Detail
The vulnerability identified in the @panopto/api-core package involves the presence of malicious code that can compromise the security of applications using this library. This issue originates from specific versions of the package (99.98.5 and 99.98.6) that have been flagged for containing harmful scripts. If exploited, this vulnerability could lead to unauthorized access, data breaches, or other malicious activities within the affected applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @panopto/api-coreIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider temporarily removing the @panopto/api-core package from your project until a safe version can be implemented. This can be done by executing:
npm uninstall @panopto/api-core
This will prevent any potential exploitation of the vulnerability while you work on a permanent fix.
Conclusion
The @panopto/api-core package has a significant vulnerability due to malicious code present in specific versions. It is crucial for developers to update to the latest version to safeguard their applications. Utilizing tools like Vulert can further enhance security by monitoring for vulnerabilities in real-time.
See every vulnerability recorded for @panopto/api-core →
FAQ
The affected versions are 99.98.5 and 99.98.6.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Exploitation of this vulnerability could lead to unauthorized access, data breaches, and other malicious activities within your application.
Yes, updating to the latest version of the @panopto/api-core package will resolve the vulnerability.
Vulert monitors and alerts for open-source vulnerabilities in your software using just the package-lock.json file, providing real-time insights into potential risks.
