Malicious Code Detected in airbnb-vermeer-node Package - Version 95.6.0
Summary
MAL-2025-190607: Malicious code in airbnb-vermeer-node (npm). Affects airbnb-vermeer-node versions 95.6.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The airbnb-vermeer-node package is a Node.js library developed by Airbnb, designed to facilitate various functionalities within web applications. It is widely used in the npm ecosystem for its ease of integration and robust features. However, version 95.6.0 of this package has been flagged for malicious behavior, specifically for communicating with a domain linked to malicious activities, raising significant security concerns for users.
Vulnerability Detail
The vulnerability in the airbnb-vermeer-node package arises from its ability to communicate with a domain associated with malicious activities. This behavior poses a risk of data exfiltration, unauthorized access, and potential compromise of the systems utilizing this package. The origin of this vulnerability has been traced back to the package analysis conducted by OpenSSF, which identified the malicious nature of the package in its current version.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall airbnb-vermeer-nodeIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the airbnb-vermeer-node package from their project to mitigate the risk associated with this vulnerability. This can be done using the command: npm uninstall airbnb-vermeer-node.
Conclusion
The airbnb-vermeer-node package version 95.6.0 has been identified as malicious due to its communication with a harmful domain. Users are advised to uninstall the package until a secure version is available and to monitor their applications for vulnerabilities using tools like Vulert.
See every vulnerability recorded for airbnb-vermeer-node →
FAQ
The airbnb-vermeer-node package is a Node.js library developed by Airbnb, used for various functionalities in web applications.
Version 95.6.0 is considered malicious because it communicates with a domain linked to malicious activities, posing security risks.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Check your application using the Vulert playground at Vulert Scanner.
If you are using version 95.6.0, it is recommended to uninstall the package until a secure version is released.
Currently, there is no patched version available for the airbnb-vermeer-node package. Users should keep an eye on updates from the package maintainers.
