Malicious Code Vulnerability in baidu-oscp Package - Version 19.9.31
Summary
MAL-2025-192424: Malicious code in baidu-oscp (npm). Affects baidu-oscp versions 19.9.30 – 19.9.31. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The baidu-oscp package is a Node.js library available via npm, designed for various functionalities related to the Baidu Open Cloud Platform. It is widely used in applications that require integration with Baidu services. However, the package has been identified as malicious due to its execution of harmful commands, posing a significant risk to users and their applications.
Vulnerability Detail
The vulnerability originates from the malicious behavior embedded in the baidu-oscp package versions 19.9.30 and 19.9.31. This behavior includes executing commands that can compromise the security of the host system, leading to potential data breaches or unauthorized access. The OpenSSF Package Analysis project flagged this package as malicious, indicating that users should exercise caution when using it.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall baidu-oscpIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the baidu-oscp package from their project until a secure version is confirmed. This can be done using the command: npm uninstall baidu-oscp.
Conclusion
The baidu-oscp package has been identified as malicious, with specific versions executing harmful commands. Users are advised to update or remove the package to mitigate risks. Utilizing tools like Vulert can help monitor for such vulnerabilities in real-time.
See every vulnerability recorded for baidu-oscp →
FAQ
The baidu-oscp package is a Node.js library that facilitates integration with the Baidu Open Cloud Platform, providing various functionalities for developers.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If you are using baidu-oscp version 19.9.30 or 19.9.31, it is crucial to update to the latest version or remove the package until a secure version is available.
Using the malicious baidu-oscp package can lead to unauthorized access, data breaches, and other security issues that can compromise your application and its users.
You can visit the OpenSSF Package Analysis project or check resources like Vulert for detailed insights and monitoring of open-source vulnerabilities.
