Critical Malicious Code Vulnerability in @voiceflow/pino Package
Summary
MAL-2025-191364: Malicious code in @voiceflow/pino (npm). Affects @voiceflow/pino versions 6.11.3 – 6.11.4. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The @voiceflow/pino package is a logging library designed for use with Node.js applications, providing structured logging capabilities to enhance debugging and monitoring. It is widely used in various projects due to its ease of integration and performance. However, the package has recently been compromised, exposing users to significant security risks.
Vulnerability Detail
The vulnerability stems from a malicious payload introduced by the Sha1-Hulud: The Second Coming NPM worm. This worm is capable of stealing sensitive tokens and credentials from users and publishing them to GitHub. Furthermore, it can propagate itself to other NPM packages owned by the user and establish persistence through GitHub actions. The worm poses a severe threat as it may also destroy the user's home directory, leading to potential data loss.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall @voiceflow/pinoIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users should consider removing the @voiceflow/pino package from their projects until a thorough review and update can be performed. This can be done using the following command:
npm uninstall @voiceflow/pino
Conclusion
The @voiceflow/pino package has been compromised by a malicious NPM worm, posing serious security risks to users. Immediate action is required to update the package and mitigate potential damage. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for @voiceflow/pino →
FAQ
The vulnerability involves malicious code that can steal sensitive information and propagate itself to other packages.
You can use Vulert's playground at Vulert Scanner to check if your application is affected without needing to sign up.
If you suspect that your credentials have been compromised, immediately revoke any affected tokens and update your security practices.
Yes, Vulert provides a service that monitors your package-lock.json file for vulnerabilities in real-time.
Failure to address this vulnerability could lead to unauthorized access to sensitive data, loss of data, and further propagation of the malicious code.
