Malicious Code Injection in browser-metrics-plugin.contrib: A Dependency-Confusion Vulnerability
Summary
MAL-2026-17640: Malicious code in browser-metrics-plugin.contrib (npm). Affects browser-metrics-plugin.contrib versions 0.0.1 – 99.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The browser-metrics-plugin.contrib package is designed as a compatibility shim for various applications, allowing developers to integrate metrics tracking seamlessly. However, it has been identified as a dependency-confusion package, which poses significant security risks. This package has been exploited to execute malicious code during installation and import, compromising user data and system integrity.
Vulnerability Detail
The vulnerability stems from the malicious code embedded within the browser-metrics-plugin.contrib package. This code is executed during the post-installation phase and upon importing the package. It sends sensitive information, including the hostname, installation path, and current working directory, to a remote server over plain HTTP. This poses a severe risk as it can lead to data leakage and unauthorized access to user environments. The malicious code is present in multiple versions of the package, making it critical for users to take immediate action.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall browser-metrics-plugin.contribIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can remove the browser-metrics-plugin.contrib package from their project until a secure version is confirmed. This can be done using the command: npm uninstall browser-metrics-plugin.contrib. Additionally, consider using alternative packages that provide similar functionality without the associated risks.
Conclusion
The browser-metrics-plugin.contrib package has been identified as a significant security risk due to embedded malicious code that compromises user data. Immediate action is required to update or remove the package to protect against potential exploitation. Utilizing tools like Vulert can help monitor and manage such vulnerabilities effectively.
See every vulnerability recorded for browser-metrics-plugin.contrib →
FAQ
The vulnerability involves malicious code that sends sensitive information to a remote server during installation and import.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
If you have installed the affected package, it is crucial to uninstall it immediately and update to a secure version.
To prevent similar vulnerabilities, regularly audit your dependencies, use tools like Vulert for real-time monitoring, and avoid using packages from untrusted sources.
Failure to address this vulnerability can lead to data breaches, unauthorized access to sensitive information, and potential exploitation of your application.
