Malicious Code Detected in com.unity.sharp-zip-lib: Version 9.1.0 Vulnerability Summary
Summary
MAL-2025-191490: Malicious code in com.unity.sharp-zip-lib (npm). Affects com.unity.sharp-zip-lib versions 9.1.0. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package 'com.unity.sharp-zip-lib' is a library used in Unity for handling zip file operations. It provides developers with functionalities to compress and decompress files, making it easier to manage assets in Unity projects. However, version 9.1.0 has been flagged for malicious behavior, raising concerns about its integrity and security.
Vulnerability Detail
The vulnerability in 'com.unity.sharp-zip-lib' arises from its ability to communicate with a domain linked to malicious activities and execute commands that can compromise system security. This behavior poses significant risks, including unauthorized access to sensitive data and potential system exploitation. The origin of this vulnerability was identified by the OpenSSF Package Analysis project, which flagged the package as malicious due to its suspicious activities.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall com.unity.sharp-zip-libIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using version 9.1.0 of 'com.unity.sharp-zip-lib' and revert to a previous version that is known to be secure. You can do this by running: npm install com.unity.sharp-zip-lib@<previous_version>. Replace <previous_version> with the last known safe version number.
Conclusion
The detection of malicious code in 'com.unity.sharp-zip-lib' version 9.1.0 highlights the importance of maintaining secure dependencies in software development. Developers are encouraged to update their packages promptly and utilize tools like Vulert to monitor for vulnerabilities in their applications.
See every vulnerability recorded for com.unity.sharp-zip-lib →
FAQ
It is a library used in Unity for managing zip file operations, allowing developers to compress and decompress files.
Version 9.1.0 has been flagged for communicating with a domain associated with malicious activity and executing harmful commands.
You can use Vulert, which monitors open-source vulnerabilities in real-time. By uploading your package-lock.json file, you can check for vulnerabilities without needing to install any software.
As a workaround, you can revert to a previous version of the package that is known to be secure until an update can be applied.
Detailed information can be found on the OpenSSF Package Analysis project page and the GitHub repository for malicious packages.
