Critical Malicious Code Vulnerability in braintree-web-latest Package
Summary
MAL-2026-554: Malicious code in braintree-web-latest (npm). Affects braintree-web-latest versions 99.99.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The braintree-web-latest package is a JavaScript library used for integrating payment processing solutions into web applications. It provides developers with tools to handle transactions securely and efficiently. However, the package version 99.99.1 has been identified as malicious, posing significant risks to applications that utilize it.
Vulnerability Detail
The vulnerability stems from the braintree-web-latest package communicating with a domain linked to malicious activities. It executes commands that can lead to unauthorized access or manipulation of the host system. This behavior compromises the integrity and security of applications using this package, potentially exposing sensitive user data and leading to financial loss.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall braintree-web-latestIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the braintree-web-latest package from your project until a secure version is confirmed. You can do this by running:
npm uninstall braintree-web-latest
This will prevent any malicious code from executing in your application.
Conclusion
The braintree-web-latest package version 99.99.1 has been identified as malicious, posing serious security risks. It is crucial to update or remove this package to protect your application from potential threats. Utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for braintree-web-latest →
FAQ
It is a JavaScript library used for integrating payment processing solutions into web applications.
The malicious code can communicate with harmful domains and execute unauthorized commands, compromising your application's security.
You should immediately update the package to a secure version or remove it from your project.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time using just package-lock.json.
Yes, you can use the Vulert playground at Vulert Scanner to check for vulnerabilities without any signup.
