Malicious Code Detected in @testfeii/hallo-word Package - Version 0.0.1
Summary
MAL-2026-192: Malicious code in @testfeii/hallo-word (npm). Affects @testfeii/hallo-word versions 0.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @testfeii/hallo-word package is an npm module designed for developers to integrate a simple greeting functionality into their applications. However, this specific version (0.0.1) has been flagged for containing malicious code that executes harmful commands, posing a significant risk to users and their systems.
Vulnerability Detail
The vulnerability originates from the package '@testfeii/hallo-word' version 0.0.1, identified by the OpenSSF Package Analysis project. It is considered malicious due to its ability to execute commands associated with harmful behavior, which can lead to unauthorized access, data breaches, or system compromise. Users of this package are at risk of having their systems manipulated or compromised by the malicious code embedded within.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @testfeii/hallo-wordIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can remove the package from your project by executing the following command in your terminal: npm uninstall @testfeii/hallo-word. This will prevent any malicious code from executing in your application.
Conclusion
The @testfeii/hallo-word package version 0.0.1 has been identified as malicious, executing harmful commands that can compromise user systems. It is crucial to uninstall this package and monitor for updates or patches. Utilizing tools like Vulert can aid in identifying such vulnerabilities in the future.
See every vulnerability recorded for @testfeii/hallo-word →
FAQ
The package executes commands that can lead to unauthorized access and potential system compromise.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Currently, version 0.0.1 is flagged as malicious. It is advisable to avoid using this package until a safe version is released.
You should uninstall the package immediately using the command: npm uninstall @testfeii/hallo-word.
Vulert uses your package-lock.json file to monitor for vulnerabilities and provides real-time alerts, helping you maintain the security of your software.
