Malicious Code Injection in async-node-sass-fork-pulsar Package
Summary
MAL-2025-139631: Malicious code in async-node-sass-fork-pulsar (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The async-node-sass-fork-pulsar package is a Node.js library that serves as a fork of the popular node-sass package, allowing developers to compile Sass stylesheets into CSS. This package is typically used in web development projects to streamline the styling process. However, it has been identified as part of a malicious campaign that exploits npm's package ecosystem, leading to significant security concerns.
Vulnerability Detail
The vulnerability in async-node-sass-fork-pulsar originates from its association with the tea.xyz token reward campaign, which floods the npm registry with malicious packages. These packages contain scripts designed to manipulate package.json files, removing private flags, altering version numbers, and generating random package names to inflate developer reputation scores. The continuous republishing of these variants pollutes the npm registry, posing risks such as unauthorized access to sensitive data and potential exploitation of affected applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall async-node-sass-fork-pulsarIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider using alternative packages that provide similar functionality without the associated risks. For instance, you can use the original node-sass package or other well-maintained Sass compilers.
Conclusion
The async-node-sass-fork-pulsar package poses significant security risks due to its malicious code injection. It is essential for developers to remove this package and monitor their applications for vulnerabilities to ensure the integrity and security of their projects.
See every vulnerability recorded for async-node-sass-fork-pulsar →
FAQ
It is a Node.js library used for compiling Sass stylesheets into CSS, but it has been identified as part of a malicious campaign.
The vulnerability can lead to unauthorized modifications of your package.json file, potentially exposing sensitive data and compromising your application.
You should uninstall the async-node-sass-fork-pulsar package immediately and consider using alternative packages.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just your package-lock.json file.
Yes, you can use the Vulert playground at Vulert Scanner to check for vulnerabilities in your application without any signup.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.