Critical Malicious Code Vulnerability in @quick-start-soft/quick-git-clean-markdown Package
Summary
MAL-2025-190820: Malicious code in @quick-start-soft/quick-git-clean-markdown (npm). Affects @quick-start-soft/quick-git-clean-markdown versions 1.4.2511142126. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @quick-start-soft/quick-git-clean-markdown package is an npm library designed to assist users in cleaning up markdown files in a Git repository. It is intended to streamline the process of managing markdown content within version control systems. However, this package has been compromised, embedding malicious code that poses significant security risks to users and their systems.
Vulnerability Detail
The vulnerability originates from the package containing embedded malicious code, which can fully compromise any computer that has this package installed or running. The ramifications include unauthorized access to sensitive information, such as secrets and keys stored on the affected computer. Users are advised to treat any system with this package as fully compromised, as the malicious code may persist even after the package is removed.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @quick-start-soft/quick-git-clean-markdownIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users should refrain from using the @quick-start-soft/quick-git-clean-markdown package and look for alternative packages that provide similar functionality without the security risks. Additionally, ensure that your system is monitored for any unusual activity following the removal of the package.
Conclusion
The @quick-start-soft/quick-git-clean-markdown package has been identified as containing malicious code that compromises user systems. Immediate action is required to uninstall the package and secure any sensitive information. Users should seek alternative solutions and utilize tools like Vulert to monitor for vulnerabilities.
See every vulnerability recorded for @quick-start-soft/quick-git-clean-markdown →
FAQ
Immediately uninstall the package and rotate any sensitive information stored on the affected system.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
No, there is currently no patched version available for the @quick-start-soft/quick-git-clean-markdown package.
Failing to address this vulnerability can lead to unauthorized access to sensitive data and potential further compromise of your system.
It is highly discouraged to use this package due to the embedded malicious code, even with precautions.
