Critical Malicious Code Vulnerability in brioche-apl-dev-env Package
Summary
MAL-2026-17432: Malicious code in brioche-apl-dev-env (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The brioche-apl-dev-env package is a dependency-confusion package designed to mimic an internal project. It uses an inflated version number (100.0.0) to outrank private registry versions. This package runs a preinstall script that collects sensitive information about the user's environment and sends it to a remote server.
Vulnerability Detail
The vulnerability arises from the malicious code embedded in the setup.js file, which is executed during the preinstall phase of the npm install process. This script collects sensitive information such as hostname, username, working directory, OS, architecture, Node.js version, and npm registry configuration, and sends it to a remote server via an HTTPS POST request. The implications of this vulnerability include unauthorized data collection and potential exposure of sensitive user information.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall brioche-apl-dev-envIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can prevent the execution of the preinstall script by using the following command when installing packages: npm install --ignore-scripts. However, this may not be a long-term solution, and it is advisable to remove the package entirely.
Conclusion
The brioche-apl-dev-env package contains a critical vulnerability due to embedded malicious code that collects sensitive information. It is crucial to remove this package and monitor your application for potential impacts. Utilizing tools like Vulert can help in identifying such vulnerabilities in the future.
See every vulnerability recorded for brioche-apl-dev-env →
FAQ
It is a dependency-confusion package that mimics an internal project and runs a malicious script during installation.
The vulnerability can lead to unauthorized data collection from your environment, exposing sensitive information.
You should remove the brioche-apl-dev-env package immediately and monitor your environment for any suspicious activity.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
Vulert is a tool that monitors open-source vulnerabilities in your software using just the package-lock.json file, providing real-time alerts.
