Critical Security Breach in @voiceflow/openai: Malicious Code Detected
Summary
MAL-2025-191363: Malicious code in @voiceflow/openai (npm). Affects @voiceflow/openai versions 3.2.2 – 3.2.3. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The @voiceflow/openai package is a widely used library in the npm ecosystem that facilitates integration with OpenAI's services. It provides developers with tools to build voice applications using AI capabilities. However, this package has recently been compromised, exposing users to significant security risks.
Vulnerability Detail
The vulnerability stems from a malicious code injection by the Sha1-Hulud: The Second Coming NPM worm. This worm is designed to steal sensitive tokens and credentials from users and publish them to GitHub. Additionally, it can propagate itself to other npm packages owned by the user and establish persistence through GitHub actions. The malicious payload poses a risk of destroying the user's home directory, leading to potential data loss.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @voiceflow/openaiIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the compromised package from their project until a secure version is confirmed. This can be done using the command: npm uninstall @voiceflow/openai. Additionally, review and revoke any exposed tokens or credentials that may have been compromised.
Conclusion
The @voiceflow/openai package has been compromised by a malicious worm that poses serious security risks to users. It is crucial to update the package to the latest version and monitor for any signs of compromise. Utilizing tools like Vulert can help maintain the security of your applications.
See every vulnerability recorded for @voiceflow/openai →
FAQ
The malicious code is designed to steal sensitive information such as tokens and credentials, and it can also destroy files in the user's home directory.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you suspect that you have been compromised, revoke any exposed tokens or credentials immediately and update the @voiceflow/openai package to the latest version.
Yes, Vulert can monitor your project for open-source vulnerabilities in real-time using just the package-lock.json file.
Failing to address this vulnerability can lead to unauthorized access to sensitive information, potential data loss, and further propagation of the malicious code to other packages.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
