Malicious Code Exfiltration in action-slack-message-root Package
Summary
MAL-2026-16323: Malicious code in action-slack-message-root (npm). Affects action-slack-message-root versions 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The action-slack-message-root package is designed to facilitate Slack notifications within applications. However, it has been found to contain malicious code that performs reconnaissance on the host system. This package, resembling legitimate Slack tooling, has been compromised to exfiltrate sensitive information without any of the advertised functionality.
Vulnerability Detail
The vulnerability originates from the package's preinstall script defined in package.json, which executes 'node index.js' during npm install. This script collects sensitive host information, including the hostname, platform, architecture, release, uptime, CPU details, and memory information. It also executes shell commands like 'whoami', 'id', 'pwd', and 'uname -a' to gather further data. The collected information is then sent over plain HTTP to a hardcoded Burp Suite Collaborator subdomain, exposing the host to potential data breaches. The package's dependency on openmct-heatmap ^1.0.1 further complicates the issue, as it may introduce additional vulnerabilities.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall action-slack-message-rootIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can prevent the execution of the malicious script by avoiding the installation of the action-slack-message-root package. If you have already installed it, you can remove it using the command: npm uninstall action-slack-message-root.
Conclusion
The action-slack-message-root package contains a serious vulnerability that allows malicious code to exfiltrate sensitive information from the host system. Immediate action is required to remove the package and safeguard your system. Utilize tools like Vulert for ongoing monitoring of your dependencies.
See every vulnerability recorded for action-slack-message-root →
FAQ
It is a package intended for sending Slack notifications, but it has been compromised to include malicious code.
The vulnerability allows the package to collect sensitive information from your system and send it to an external server, potentially leading to data breaches.
You should uninstall the package immediately and monitor your system for any suspicious activity.
Yes, you can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. You can check your application using the Vulert playground at Vulert Scanner without any signup.
Regularly audit your dependencies, use tools like Vulert to monitor for vulnerabilities, and ensure to only use trusted packages.
