Malicious Code Detected in cms-catalogue Package - Version 99.0.0
Summary
MAL-2026-2011: Malicious code in cms-catalogue (npm). Affects cms-catalogue versions 99.0.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The cms-catalogue package is an npm library designed for managing and displaying product catalogs in web applications. It provides functionalities such as product listings, category management, and integration with various e-commerce platforms. However, version 99.0.0 has been flagged for containing malicious code that compromises its integrity and security.
Vulnerability Detail
The vulnerability in the cms-catalogue package arises from its ability to communicate with a domain linked to malicious activities. Additionally, it executes commands that are associated with harmful behavior, potentially leading to unauthorized access, data breaches, or system compromise. This vulnerability was identified by the OpenSSF Package Analysis project, which highlighted the risks associated with using this specific version of the package.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall cms-catalogueIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, consider removing the cms-catalogue package from your project until a secure version is released. You can do this by running the command: npm uninstall cms-catalogue. Additionally, monitor your application for any unusual behavior that may indicate exploitation of this vulnerability.
Conclusion
The cms-catalogue package version 99.0.0 has been identified as malicious due to its communication with harmful domains and execution of malicious commands. It is crucial to update or remove this package to safeguard your application from potential threats. Utilize tools like Vulert for ongoing monitoring of vulnerabilities in your software.
See every vulnerability recorded for cms-catalogue →
FAQ
The cms-catalogue package is an npm library used for managing product catalogs in web applications, offering features like product listings and category management.
Version 99.0.0 is considered malicious because it communicates with a domain associated with malicious activities and executes harmful commands.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check if your application is affected without needing to sign up.
If immediate updates are not possible, consider removing the package temporarily and monitoring your application for any suspicious activity.
Detailed information about this vulnerability can be found in the OpenSSF Package Analysis project documentation and the associated GitHub repository.
