Malicious Code Detected in captcha-paypal Package: Version 2.0.0
Summary
MAL-2025-190568: Malicious code in captcha-paypal (npm). Affects captcha-paypal versions 2.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The captcha-paypal package, available through npm, is designed to facilitate the integration of CAPTCHA verification with PayPal transactions. It aims to enhance security by ensuring that users are human and not bots. However, version 2.0.0 of this package has been flagged for malicious behavior, raising concerns about its integrity and the safety of applications that utilize it.
Vulnerability Detail
The vulnerability stems from the malicious nature of the captcha-paypal package version 2.0.0, which has been identified by the OpenSSF Package Analysis project. The package communicates with a domain linked to malicious activities and executes commands that are associated with harmful behavior. This poses significant risks, including data breaches, unauthorized access, and potential exploitation of the systems using this package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall captcha-paypalIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can remove the captcha-paypal package from your project by running the following command: npm uninstall captcha-paypal. Consider using alternative CAPTCHA solutions that do not exhibit malicious behavior.
Conclusion
The captcha-paypal package version 2.0.0 has been identified as malicious, posing significant risks to applications that utilize it. Users are advised to remove this package and monitor for secure alternatives. Utilizing tools like Vulert can help maintain the security of your software by providing real-time alerts for vulnerabilities.
See every vulnerability recorded for captcha-paypal →
FAQ
The captcha-paypal package is an npm library designed to integrate CAPTCHA verification with PayPal transactions to enhance security.
Version 2.0.0 has been flagged for communicating with a domain associated with malicious activity and executing harmful commands.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
You should uninstall the package immediately and consider using a secure alternative. Monitor for any updates or patches from the package maintainers.
Vulert uses the package-lock.json file to monitor and alert in real-time for open-source vulnerabilities, ensuring your application remains secure.
