Malicious Code Vulnerability in catwrestlingbird Package
Summary
MAL-2026-16327: Malicious code in catwrestlingbird (npm). Affects catwrestlingbird versions 1.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The catwrestlingbird package, available on npm, is designed for unspecified functionality, but its description is notably empty. This lack of transparency raises concerns about its purpose and safety. The package has been identified as containing malicious code that executes upon installation, posing significant risks to users and their systems.
Vulnerability Detail
The vulnerability originates from a postinstall script in the catwrestlingbird package that runs automatically during npm installation. This script, install.js, collects sensitive information from the host system and sends it to a hardcoded HTTP endpoint. It also establishes a persistent connection to a command-and-control server, allowing remote control of the user's shell. The malicious behavior includes the ability to execute arbitrary commands and self-destruct the package, making it difficult to detect and remove. The presence of this malicious code can lead to severe security breaches, data theft, and unauthorized access to the user's system.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall catwrestlingbirdIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
There are no effective workarounds for this vulnerability other than uninstalling the package. If you need similar functionality, consider using alternative packages that are well-reviewed and have a clear purpose.
Conclusion
The catwrestlingbird package contains malicious code that poses significant risks to users. Immediate removal of the package is necessary to protect your system. Utilizing tools like Vulert can help monitor for such vulnerabilities in the future.
See every vulnerability recorded for catwrestlingbird →
FAQ
The catwrestlingbird package is an npm package with an empty description, raising concerns about its purpose and safety.
The malicious code collects sensitive information from the host system and communicates with a command-and-control server, allowing remote access to the shell.
The risks include unauthorized access to your system, data theft, and potential damage to your environment due to arbitrary command execution.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
To prevent similar vulnerabilities, always review package dependencies, check for known vulnerabilities, and use tools like Vulert to monitor your projects.
