Malicious Code Injection in apollo-express-await-sadr Package
Summary
MAL-2025-139511: Malicious code in apollo-express-await-sadr (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The apollo-express-await-sadr package is a Node.js library designed to facilitate asynchronous operations in Express applications. It is part of the npm ecosystem, which allows developers to easily share and manage JavaScript packages. However, this package has been identified as part of a malicious campaign that exploits npm's publishing mechanisms, leading to potential security risks for developers and their applications.
Vulnerability Detail
The vulnerability originates from a malicious payload embedded within the apollo-express-await-sadr package. This payload modifies the package.json file by removing private flags and altering version numbers. It also generates random package names, which can lead to the proliferation of derivative packages in the npm registry. The consequences of this vulnerability include the potential for developers to unknowingly install compromised packages, which can affect application integrity and security.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall apollo-express-await-sadrIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using the apollo-express-await-sadr package until a secure version is released. Additionally, you can monitor your package-lock.json file for any unexpected changes or additions that may indicate the presence of malicious packages.
Conclusion
The apollo-express-await-sadr package has been identified as containing malicious code that can compromise application security. It is crucial for developers to take immediate action by updating or removing the package and to utilize tools like Vulert for ongoing vulnerability monitoring.
See every vulnerability recorded for apollo-express-await-sadr →
FAQ
It is a Node.js library used for handling asynchronous operations in Express applications.
The vulnerability can lead to the installation of compromised packages, which may introduce security risks and affect application functionality.
You should update the package to a patched version or remove it from your project to mitigate the risks.
You can use tools like Vulert, which monitors your package-lock.json file for open-source vulnerabilities in real-time.
Yes, you can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without any signup.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.