Malicious Code Detected in banquet-runtime-modules: Version 75.1.0 Vulnerability
Summary
MAL-2026-607: Malicious code in banquet-runtime-modules (npm). Affects banquet-runtime-modules versions 75.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The 'banquet-runtime-modules' package is a component of the npm ecosystem, designed to facilitate various runtime functionalities for applications. It is widely used due to its ease of integration and extensive feature set. However, version 75.1.0 has been flagged for malicious activity, which poses a significant risk to users relying on this package for their projects.
Vulnerability Detail
The vulnerability in 'banquet-runtime-modules' arises from its communication with a domain linked to malicious activities. This behavior can lead to unauthorized data access, potential data breaches, and exploitation of the affected systems. The origin of this vulnerability was identified by the OpenSSF Package Analysis project, which flagged the package as malicious due to its suspicious network activity.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall banquet-runtime-modulesIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can remove the 'banquet-runtime-modules' package from your project until a secure version is confirmed. Use the following command to uninstall the package: npm uninstall banquet-runtime-modules.
Conclusion
The 'banquet-runtime-modules' package version 75.1.0 has been identified as malicious due to its communication with harmful domains. Users are advised to update or remove the package to safeguard their applications. Utilizing tools like Vulert can help in monitoring vulnerabilities effectively.
See every vulnerability recorded for banquet-runtime-modules →
FAQ
The package has been found to communicate with a domain known for malicious activities, which can compromise user data and system integrity.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If an immediate update is not possible, consider removing the package from your project as a temporary workaround to mitigate risks.
Detailed information about the vulnerability can be found in the OpenSSF Package Analysis report and the official GitHub repository.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities using just your package-lock.json file.
