Critical Malicious Code Vulnerability in cdd-plugin-for-datawarrior
Summary
MAL-2025-192966: Malicious code in cdd-plugin-for-datawarrior (npm). Affected versions are not published. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The cdd-plugin-for-datawarrior is an npm package designed to enhance the functionality of the DataWarrior software, providing users with additional tools and features. However, this package has been identified as containing malicious code, which poses a significant risk to any system that has it installed. The vulnerability allows unauthorized access to sensitive data and system controls, making it imperative for users to take immediate action.
Vulnerability Detail
The vulnerability stems from the presence of embedded malicious code within the cdd-plugin-for-datawarrior package. This code can compromise any computer that has the package installed, allowing attackers to gain full control over the system. The ramifications include unauthorized access to sensitive information, potential data breaches, and the risk of further malware installation. Users are advised to treat any system with this package as fully compromised.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall cdd-plugin-for-datawarriorIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
Currently, there are no effective workarounds to mitigate the risks associated with this vulnerability other than removing the package. Users should ensure that they do not run any applications that depend on this plugin until it has been completely uninstalled.
Conclusion
The cdd-plugin-for-datawarrior package has been identified as containing malicious code that poses a serious threat to users. Immediate action is required to uninstall the package and secure any sensitive data. Users are encouraged to utilize tools like Vulert to monitor their applications for vulnerabilities.
See every vulnerability recorded for cdd-plugin-for-datawarrior →
FAQ
You should immediately uninstall the package and rotate any sensitive information stored on the affected system.
You can use the Vulert playground at Vulert Scanner to check if your application is affected without requiring any signup.
No, there is currently no patched version available for this package.
Failure to remove the package can lead to unauthorized access to your system, data breaches, and further malware infections.
Vulert uses the package-lock.json file to monitor and alert in real-time for open-source vulnerabilities in your software.
References
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
