Critical Malicious Code Vulnerability in @subql/common Package
Summary
MAL-2026-17571: Malicious code in @subql/common (npm). Affects @subql/common versions 5.8.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @subql/common package is a JavaScript library used in the Substrate ecosystem for building decentralized applications. It provides essential functionalities for managing data and interactions within Substrate-based projects. However, a severe vulnerability has been identified that allows for arbitrary code execution during the installation process, compromising the security of any system that uses this package.
Vulnerability Detail
The vulnerability originates from a malicious postinstall hook defined in the package's package.json file. This hook executes a script that decodes and executes embedded base64-encoded malicious code, allowing attackers to gain arbitrary control over the affected system. The malicious code is triggered during every npm install without any user consent or visible payload, making it particularly dangerous. The source map for the malicious script has been scrubbed to hide the true nature of the code, complicating detection efforts.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @subql/commonIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the @subql/common package from your project by executing: npm uninstall @subql/common. This will prevent the execution of the malicious code until a patched version is released.
Conclusion
The @subql/common package has a critical vulnerability that allows for arbitrary code execution, posing significant risks to any system using it. Immediate action is required to mitigate the threat by updating or removing the package. Continuous monitoring and security practices are essential to safeguard against such vulnerabilities in the future.
See every vulnerability recorded for @subql/common →
FAQ
The vulnerability involves malicious code execution during the npm install process, allowing attackers to gain control over the affected system.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
If you have installed the affected version of @subql/common, it is recommended to uninstall the package immediately and rotate any sensitive credentials stored on the affected system.
To prevent similar vulnerabilities, regularly audit your dependencies, use tools like Vulert for monitoring, and avoid using packages from untrusted sources.
While removing the package will stop the execution of the malicious code, there is no guarantee that all traces of the malware will be removed. It is advisable to perform a thorough security audit of the affected system.
