Malicious Code Detected in brass-common Package - Version 99.9.1
Summary
MAL-2026-17849: Malicious code in brass-common (npm). Affects brass-common versions 99.9.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The brass-common package is a library used in Node.js applications, primarily for common functionalities that can be shared across different modules. It is widely utilized in various npm projects due to its ease of integration and utility functions. However, version 99.9.1 has been flagged for malicious behavior, which poses a significant risk to applications relying on this package.
Vulnerability Detail
The vulnerability in the brass-common package arises from its communication with a domain linked to malicious activities. This behavior can lead to data breaches, unauthorized access, and potential exploitation of the systems using this package. The OpenSSF Package Analysis project identified this issue, highlighting the risks associated with using the affected version.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall brass-commonIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
If immediate updating is not feasible, consider removing the brass-common package from your project until a secure version is released. You can do this by running: 'npm uninstall brass-common'. This will prevent any malicious code from executing in your application.
Conclusion
The brass-common package version 99.9.1 has been identified as malicious, posing significant risks to applications that utilize it. It is crucial to update to a secure version or remove the package to protect your system. Regular monitoring of dependencies is recommended to avoid similar vulnerabilities in the future.
See every vulnerability recorded for brass-common →
FAQ
brass-common is a Node.js library used for common functionalities in various npm projects.
A malicious package contains code that can harm your system, such as stealing data or allowing unauthorized access.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
Consider uninstalling the brass-common package temporarily to mitigate risks until a secure version is available.
Utilize tools like Vulert to receive real-time alerts for open-source vulnerabilities in your software.
