Malicious Code Injection in astro Package - Version 7.1.0
Summary
MAL-2026-10726: Malicious code in astro (npm). Affects astro versions 7.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The astro package is a popular tool in the npm ecosystem, primarily used for building fast websites. It allows developers to create static sites with a focus on performance and simplicity. However, the version 7.1.0 of this package has been found to contain malicious code that impersonates the legitimate astro project, posing significant security risks to users.
Vulnerability Detail
The vulnerability arises from the release of astro version 7.1.0, which does not match the legitimate withastro/astro project. Instead, it contains dependencies with typosquatted names that lead to malicious packages. These packages are imported unconditionally in core modules, meaning that any invocation of 'require('astro')' or use of the CLI will execute attacker-controlled code. This can lead to unauthorized access, data breaches, and further exploitation of the user's environment.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall astroIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the astro package version 7.1.0. Instead, utilize the legitimate version 5.x until a secure patch is confirmed. You can also monitor your dependencies using tools like Vulert, which alerts you to vulnerabilities in real-time.
Conclusion
The discovery of malicious code in the astro package version 7.1.0 highlights the importance of vigilance when managing dependencies in software projects. Users are strongly advised to update to the legitimate version and utilize monitoring tools like Vulert to stay informed about potential vulnerabilities.
See every vulnerability recorded for astro →
FAQ
Astro is a framework for building fast websites, allowing developers to create static sites efficiently.
The malicious code can execute unauthorized actions within your project, potentially leading to data breaches or system compromise.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
Immediately uninstall the affected version and install the legitimate version 5.x of the astro package.
Regularly update your dependencies, use tools like Vulert for monitoring vulnerabilities, and be cautious of packages with unusual naming conventions.
References
Related vulnerabilities
Recent vulnerabilities recorded for astro.
