Malicious Code Detected in @schedaero/bacon: Data Exfiltration and Process Termination
Summary
MAL-2026-1228: Malicious code in @schedaero/bacon (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @schedaero/bacon package is a Node.js library available on npm, designed for specific functionalities within the software ecosystem. However, it has been identified with multiple suspicious behaviors, including a preinstall script that exfiltrates sensitive data to an external URL, leading to potential security risks for users who integrate this package into their applications.
Vulnerability Detail
The vulnerability originates from the preinstall script of the @schedaero/bacon package, which is designed to execute before the package is installed. This script has been found to exfiltrate data to a suspicious URL, potentially compromising user data. Additionally, it has the capability to terminate the installation process, which can disrupt application functionality. The presence of these malicious behaviors raises significant security concerns for developers and users relying on this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @schedaero/baconIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the @schedaero/bacon package until a secure version is released. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The @schedaero/bacon package has been identified with serious vulnerabilities due to malicious code that can exfiltrate data and disrupt installations. It is crucial for developers to take immediate action by updating or removing the package and to utilize tools like Vulert for ongoing monitoring of vulnerabilities in their applications.
See every vulnerability recorded for @schedaero/bacon →
FAQ
The primary issue is the presence of a malicious preinstall script that exfiltrates data to a suspicious URL and can terminate the installation process.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
If you are using @schedaero/bacon, it is recommended to update the package to the latest version or consider removing it until a secure version is available.
Yes, there are several alternative packages available on npm that provide similar functionalities without the associated security risks. Research and evaluate these alternatives based on your project requirements.
Regularly update your dependencies, monitor for vulnerabilities using tools like Vulert, and conduct security audits of your codebase to enhance your application's security.
